Static Web Hosting on the Intel N150
Mood
thoughtful
Sentiment
positive
Category
tech
Key topics
Static Web Hosting
Intel N150
Operating System Comparison
The article compares the performance of various operating systems (FreeBSD, SmartOS, NetBSD, OpenBSD, and Linux) on the Intel N150 for static web hosting, sparking discussion on benchmarking, configuration, and hardware capabilities.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
2h
Peak period
71
Day 1
Avg / period
37
Based on 74 loaded comments
Key moments
- 01Story posted
Nov 19, 2025 at 12:22 PM EST
4d ago
Step 01 - 02First comment
Nov 19, 2025 at 2:39 PM EST
2h after posting
Step 02 - 03Peak activity
71 comments in Day 1
Hottest window of the conversation
Step 03 - 04Latest activity
Nov 20, 2025 at 3:43 PM EST
3d ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
WARNING: UEFI capsule updates not available or enabled in firmware setup
See https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported for more information.
Host Security ID: HSI:0! (v2.0.8)
HSI-1
csme override: Locked
csme v0:16.50.15.1515: Valid
Platform debugging: Disabled
SPI write: Disabled
Supported CPU: Valid
TPM empty PCRs: Valid
TPM v2.0: Found
UEFI bootservice variables: Locked
UEFI secure boot: Enabled
BIOS firmware updates: Disabled
csme manufacturing mode: Unlocked
SPI lock: Disabled
SPI BIOS region: Unlocked
UEFI platform key: Invalid
HSI-2
Intel BootGuard: Enabled
IOMMU: Enabled
Platform debugging: Locked
TPM PCR0 reconstruction: Valid
Intel BootGuard ACM protected: Invalid
Intel BootGuard OTP fuse: Invalid
Intel BootGuard verified boot: Invalid
HSI-3
CET Platform: Supported
Intel BootGuard error policy: Invalid
Pre-boot DMA protection: Disabled
Suspend-to-idle: Disabled
Suspend-to-ram: Enabled
HSI-4
SMAP: Enabled
Encrypted RAM: Not supported
Runtime Suffix -!
fwupd plugins: Untainted
Linux kernel lockdown: Enabled
Linux kernel: Untainted
CET OS Support: Not supported
Linux swap: Unencrypted
UEFI db: Invalid
This system has a low HSI security level.
» https://fwupd.github.io/hsi.html#low-security-level
This system has HSI runtime issues.
» https://fwupd.github.io/hsi.html#hsi-runtime-suffix[0] My experience with that mini computer: I bought two. The first one was great, but the 2nd one had coil whine so I had to return it. Aside from the whine, I love the box. If I could guarantee I wouldn't get whine I'd buy another today.
Also it doesn't look like they enabled sendfile() in the nginx conf: https://nginx.org/en/docs/http/ngx_http_core_module.html#sen...
The combination of sendfile and kTLS should avoid round-trips to userland while sending files.
Mind, the whole "its slow get new hardware" comes from the fact that getting another 10% by tuning "won't fix the problem". By the time folks feel the sluggish performance, you're probably not looking for another 10 points. The 10 points matter at scale to lower overall hardware costs. 10% less hardware with a 1000 servers is a different problem with 10% less hardware with just one.
But, still, a tuning blog would be interesting, at least to me.
If one of the OSs has features that improve performance, why would you not include that in the comparison?
But I also understand, that looking at that might have beyond the scope of the article.
I know sendfile originally had some sharp edges, but I'm not sure how sharp it still is? You would need to use sendfile only for plain http or https with kTLS, and maybe that's too complex? Apache lists some issues [1] with sendfile and defaults to off as well; but I don't know how many sites are still serving 2GB+ files on Itanium. :P AFAIK, lighttpd added SSL_sendfile support on by default 3 years ago, and you can turn it off if you want.
I think there's also some complexity with kTLS on implementations of kTLS that limit protocol version and cipher choices, if it's on by choice it makes sense to refuse to operate with cipher selection and kTLS cipher availability that conflict, but if kTLS is on by default, you probably need to use traditional TLS for connections where the client selects a cipher that's not eligible for kTLS. Maybe that's extra code that nobody wants to write; maybe the inconsistency of performance depending on client cipher choice is unacceptable. But it seems like a worthwhile thing to me (but I didn't make a PR, did I?)
[1] https://httpd.apache.org/docs/2.4/mod/core.html#enablesendfi...
https://www.minix.com.hk/products/minix-z150-0db-fanless-min...
I bought my first one because it’s silent. I bought my second one because I like chunky blocks of metal.
are you making the request from a single IP address source? are you aware of the limit of using the same source IP address for the same destination IP address ( and port )? ( each connection can have only a unique source address and source port to the destination, maxing out in source 65535 ports ) for the same destination
So, the industry thinks its a problem.
But my question still stands.
Are you under the impression that ECC is for catching software issues? This is precisely what I want ECC for: to let me know a stick of RAM is failing on me before I let it silent corrupt my fucking data for months on end until it completely dies.
That said, I don't run ECC in my home. I'm not willing to spend the premium in dollars, performance, or time to do it. My storage servers are all ex-desktops and I try to chase performance in a budget, ECC ram usually doesn't run at high speed and it often costs at least twice as much... that doesn't make sense for a desktop, so my servers suffer too.
Some reported a couple errors a day for months (maybe years?) but worked fine.
Some ramped up error counts over hours or days.
Some went from zero to lots in one step.
A few managed to hit uncorrectable errors; sometimes just once.
For a small number of correctable errors (< 10/day), there was no action needed, or one uncorrectable, but that kind of failure is what drives people without ECC crazy; some of the machines that hit an uncorrectable only did it once and were fine. The other ones we'd replace ram for. A small number of daily errors or a single uncorrectable were less common than the ones that got their ram swapped. I don't know for sure if uncorrectables correlated with many correctable errors, because correctable errors were only reported hourly ... if it was a step change to bad ram, it's likely to halt before a reporting interval, so no report. Unless the correctables were several a second, the impact of corrections isn't obvious.
Arm RK3399 SoC is blob free and some (Pinephone Pro, N4S, Chrome tablet) devices are small enough for sidecar usage.
It shortens the list of options, making choices much easier.
The cheaper and most popular one is N150 [2] which is a replacement for N100 [3]. The newer one boosts a bit higher. The 6-7W TDP in specs is a lie, but these CPUs still have fairly modest consumption working at about 10-20W on average.
There are some low power chips from AMD, but that's mostly NAS territory. Don't see them a whole lot and don't know much about them either.
[0] https://www.techpowerup.com/cpu-specs/?f=codename_=Gracemont
[1] https://www.techpowerup.com/cpu-specs/?f=codename_=Twin%20La...
[2] https://www.techpowerup.com/cpu-specs/processor-n150.c4109
[3] https://www.techpowerup.com/cpu-specs/processor-n100.c3007
From amd side I have 4700u and 5700u, similar idle power (12w), similar cost ($200 with 32gb of ram, now more expensive). A lot more capable then n100, at a cost.
I use a whole bunch of mini pc in my lab, they are so much cheaper to run electricity wise (and cost)
Big reason why I wanted AMD is that Intel officially supports only 16GB RAM on these N series chips. Also AMD has 20 gen4 PCIe lanes vs 9 gen3 lanes for Intel.
https://www.techpowerup.com/cpu-specs/ryzen-7-pro-6850u.c276...
I've read reviews from people who put 32GB sticks in these boxes no problem. Not sure why they put "16GB max" in the specs, that's just misleading. But the CPU you ordered is way more powerful so no grief there.
If you’re willing to go up to 60W TDP and $500-1000, then they’re good enough to run recent steam games under linux at 1080p and LLM inference (if you spring for > ~32GB of RAM).
Like many others on this thread, I’ve had good luck with beelink.
Not a lot of options for N100 with PoE+ though. There is the Radxa x4 but thats hard to find and the MS S100 is quite locked down in terms of storage.
Also, ECC ram would be nice.
OTOH, maybe this is a bad test on purpose? the blogger doesn't like running these tests, so do a bad one and hope someone else is baited into running a better test?
Not much experience with Solaris zones, but FreeBSD jails and their vnets are amazingly good. They also don't lose much in translation. Say you run an Ubuntu 12.04 with a Debian 13 Docker image. Sure, it works, but it has to translate.
Jails have the restriction that a jail can't have a higher version than the host system. So there's (almost) zero translation involved.
My home stack is OpenBSD for the gateway/router, several FreeBSD machines (services, DBs, pkg build server, data storage/NAS) and another OpenBSD machine to run OpenBSD VMs via VMD and I haven't looked back since then. It's a stack that works with impeccable perfomance and equally impeccable documentation. Should the internet crumble due to another AWS us-east-1 or another cloudflare fuckup I can at least run my local stuff and feel confident enough to continue making changes to the system just based off the locally available documentation.
Otherwise, seL4/LionsOS webserver scenario could be tested.
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.