d-z-m

11 ms·

31.
by d-z-m 2y ago
Ideally I would not have to trust the signalling server to ensure I'm transferring files to who I think I am[0]. Not as much of a knock against your project as a knock against webRTC in general. [0]: https://webrtchacks.com
32.
by d-z-m 2y ago
I looked around and couldn't find a description of the protocol by which two peers authenticate to each other/transfer files. Also, is the E2EE encryption referred to simply whatever is being used to encrypt the transport(DTLS&#x
33.
by d-z-m 2y ago
In hindsight my comment was ill-considered. I'm removing it.
34.
by d-z-m 2y ago
[removed]
35.
by d-z-m 2y ago
> And I'm weary to add caching at the library level and risk exposing a side channel. You mean a cache-timing attack against adiantum?
36.
by d-z-m 2y ago
> Luckily WireGuard doesn't have this issue on desktop peers for windows split tunnels it still does, I believe.
37.
by d-z-m 2y ago
> However, it's also important to take note of how the KDF is used Agree completely. I'm glad that t=3 works for your usage requirements. Was hoping it wouldn't introduce an intolerable amount of latency. > and what is
38.
by d-z-m 2y ago
> That's unfortunate about the default parameters, but note that you can also replace the KDF altogether (besides just not using it). Right...I would argue if you're going to expose it to users as an option, your parameter set
39.
by d-z-m 2y ago
> I used the parameters suggested in the documentation [1], which follow the RFC Where in the RFC is your parameter set mentioned? I don't see it anywhere[0]. The only parameter set I see mentioned with memory requirement as low as
40.
by d-z-m 2y ago
For your KDF, how did you select the parameters for Argon2id? How often is the KDF invoked / what are your requirements for speed in KDF'ing? Nit, but your "pepper" is confusingly named IMO, because it is hardcoded and
41.
by d-z-m 2y ago
Seems misleading to phrase it this way if you aren't talking about inference tok/s.
42.
by d-z-m 2y ago
> I'm more concerned with the data they receive being leaked or sold. But that's not what we're talking about here. We were talking about a MITM attack on key/tarfile distribution in the context of verifying file int
43.
by d-z-m 2y ago
I didn't think arena was a synthetic benchmark?
44.
by d-z-m 2y ago
8B llamafile when? :^)
45.
by d-z-m 2y ago
not very good compared to what? Hard to reconcile your comment with its outsize performance on arena/glowing praise from others comparing it to much larger models.
46.
by d-z-m 2y ago
Depending on the kind of questions you're asking it, the mistral finetunes may be much better positioned to give a high quality answer. An apples-to-apples comparison IMO would be Mistral 7B instruct vs Llama3 8b instruct.
47.
by d-z-m 2y ago
Yes, however there's a big difference between Cloudflare and an arbitrary MITM. If you think Cloudflare is mangling traffic in a malicious way you would need a shred of evidence to substantiate that claim. I would also push back that
48.
by d-z-m 2y ago
> realistically if the the attacker can do the MITM he can probably also figure out how to modify the contents on the webserver, in which case TLS does nothing Sorry, I don't see how that follows. If you had access to the webserver
49.
by d-z-m 2y ago
> You have to verify downloaded tarballs authenticity to be sure that you retrieved trusted and untampered software. I'm not able to access the site over TLS, so this is currently impossible. Anyone else have better luck? (fr
50.
by d-z-m 3y ago
SillyPutty
51.
by d-z-m 3y ago
what makes it unmaintainable in your opinion?
52.
by d-z-m 3y ago
Very cool! I see this in the README under the "How is this different from other layout parsers" section. > Commercial Solutions: Requires sharing your data with a vendor. But I also see that to use the Semantic Processing examp
53.
by d-z-m 3y ago
From my understanding, the command payload is not an RSA private key. It is an SSH certificate's public key field, a section of which contains the signed command to be executed.
54.
by d-z-m 3y ago
I see it as an incentive problem. How are the maintainers of these projects to receive the support they need? Companies like AWS are incentivized to take all they can take and contribute nothing in return, "it's FOSS, baby"
55.
by d-z-m 3y ago
Big bad Redis Inc. won't let us host their software as a service anymore! Good thing AWS(champions of open-source software) are here to help! Seriously though, very duplicitous framing by AWS. Ignoring the clear existential threat to R
56.
by d-z-m 3y ago
They expected some amount of employees to leave(not sure it was 1/3 though). This was during a time when the country was in the midst of some very contentious social issues. I believe the public communique was perhaps to provide prec
57.
by d-z-m 3y ago
I wanna know what library they're using for that CRT terminal, very cool!
58.
by d-z-m 3y ago
> “I also think whoever was responsible for it should be fired,” she added. I understand she's upset, and rightfully so. However, I find the vindictiveness distasteful.
59.
by d-z-m 3y ago
any plans to support other backends besides ollama?
60.
by d-z-m 3y ago
Talking GGUF, Usually the higher you can afford to go wrt. quantization(e.g. Q5 is better than Q4, etc), the better. A Q6_K has minimal performance loss from the Q8, so in most cases if you can fit a Q6_K it's recommended to just use t

More ›