drnick1

8 ms·

181.
by drnick1 3mo ago
Linux and OpenWrt have an incredibly good security record compared to what ships on typical consumer devices.
182.
by drnick1 3mo ago
Giving sudo permissions to an agent seems reckless. Claude gets his own unprivileged UNIX account, no more. I don't bother with containers or VMs however.
183.
by drnick1 3mo ago
QEMU is also a good option for Windows software that won't run on Wine. Unless you explicitly pass through a peripheral, Windows won't see it and start downloading malware in the backgroud.
184.
by drnick1 3mo ago
> Which is very hard, because most of these devices don't work locally. Then don't buy those devices. All of my home devices are either Zigbee (local-only) or were bought specifically because they can be reflashed with open fir
185.
by drnick1 3mo ago
> In fact, the reason Linux is considered secure is simply because hardware vendors haven't standardized enough to build automatic deployment pipelines. The Linux security model (sudo to install or update software) doesn't allo
186.
by drnick1 3mo ago
Not sure what your homegrown solution is, but check out Plasma Bigscreen too.
187.
by drnick1 3mo ago
You don't have to win the hardware support lottery if you do a bit of research or buy a laptop made for it.
188.
by drnick1 3mo ago
Just use Debian. It's just as easy to install and use nowadays, and does not come with bloatware/malware.
189.
by drnick1 3mo ago
The fact that the European flag isn't seen anywhere in Europe tells you a lot about how people really feel about the E.U.
190.
by drnick1 3mo ago
Yes this. My experience with Zigbee is that it just works, but the setup and specific hardware probably matters. I use a SONOFF USB dongle through Zigbee2MQTT and Home Assistant.
191.
by drnick1 3mo ago
> No matter what you’re doing you have to trust that your home router doesn’t have an externally accessible SSH port with no password set. No, you don't have to trust. I build my own routers precisely because I don't.
192.
by drnick1 3mo ago
> Yes, sometimes it's difficult to find the correct driver for Linux and set it up. It's interesting that you say that, because it isn't how drivers normally work on Linux. Finding, downloading and installing drivers is ve
193.
by drnick1 3mo ago
This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited
194.
by drnick1 3mo ago
I wonder if that malicious feature was removed from the open release. In addition, if the builds aren't reproducible and people just run the binaries distributed by X instead of building from source, there is no guarantee that they are
195.
by drnick1 3mo ago
The Pixel can run Graphene, which means you can permanently take control of the phone and give Google the boot. The iPhone is entirely controlled by Apple, and you are one OTA away from a hostile "upgrade." By default, everything
196.
by drnick1 3mo ago
This is a systemd identifier, not strictly speaking a "Linux" identifier. In any case, an executable allowed to run on a host can trivially fingerprint the machine it is running on using a combination of hardware identifiers. Remo
197.
by drnick1 3mo ago
One more proof that Windows is malware.
198.
by drnick1 3mo ago
I'll stick to my 100% self-hosted Wireguard setup, thank you very much.
199.
by drnick1 3mo ago
Give me the explicit C syntax any day over this monstrosity. I refuse to write anything other than C++98, the last version of C++ that built on C without trying to turn it into a completely different language.
200.
by drnick1 3mo ago
> The short version: ad blockers work on browsers but not apps[0]. It depends where the ads come from. I block ads at the DNS level for example, and there is little apps can do (I also filter public DNS servers by IP to prevent bypass).
201.
by drnick1 3mo ago
It's definitely not trivial to figure out what for, and what is being sent or received.
202.
by drnick1 3mo ago
There is no need for mass surveillance of public spaces. The moment data is collected, it can be misused, so it is better that nothing be collected in the first place. This is what a truly robust privacy policy looks like, unlike absurd law
203.
by drnick1 3mo ago
How does the performance compare?
204.
by drnick1 3mo ago
It's more complex than that. LittleSnitch or other application firewalls won't help when programs like package managers legitimately need to access the Internet. And figuring what what is being sent would require decrypting the tr
205.
by drnick1 3mo ago
You are being naive. An Apple device makes dozens of network requests every minute or so to Apple. It is neigh on impossible to verify what is being requested or sent. Also unplugging the Internet and verifying that something still works do
206.
by drnick1 3mo ago
> It's not open weight, but the point is to be an on device (and thus local, privacy preserving) option. How can you be sure this isn't leaking data or metadata to Apple? Can Apple really be trusted?
207.
by drnick1 3mo ago
You should also check that mountpoints like external disks and network resources aren't publicly accessible to other users than your own.
208.
by drnick1 3mo ago
If this isn't open source/weights and can't run locally, I don't see how this is a replacement for Whisper or other open models, e.g. within Home Assistant.
209.
by drnick1 3mo ago
I would go further and not upload anything that isn't encrypted to cloud storage services. It is extremely likely that those "services" inspect your files.
210.
by drnick1 3mo ago
You should ALWAYS run your agent as separate, unprivileged, UNIX user, never in your main account. If you absolutely need to run it as your own user, you should bubblewrap it. I do this for things like Steam, games, or other "blackbox&

More ›