lrvick

16 ms·

301.
by lrvick 4mo ago
Not really much to write up. Insert 2-4 $1200 r9700 GPUs in a Linux 7.0.0+ machine with 64GB+ of DDR4-5 memory, fire up llama.cpp, and connect with any OpenAI compatible tools. A free public anonymous LLM like BigPickle can easily set up th
302.
by lrvick 4mo ago
Yeah, first "real" startup and we were absolutely desperate for some seed cash. Mistakes were made. These days I have significantly higher self respect, always have multiple income and funding sources, and a lot more protective of
303.
by lrvick 4mo ago
Being capable of sshing to servers to maintain things sure was.
304.
by lrvick 4mo ago
In the end my co-founders and investors wanted to sell to a single specific political party exclusively. I chose not to participate as it did not align with my goals, and started a small IT company instead. The original project was dead wit
305.
by lrvick 4mo ago
Maybe 2 months. I have mostly used the Qwen series, and currently running Qwen3.6 27B for programming and debugging and Qwen3.6 35B for speed and research. Both punch way way above their weight and replaced Qwen3.5 122B for me. Qwen 3.6 27B
306.
by lrvick 4mo ago
Buy a few GPUs so you can skip the Claude subscription, and never have to worry about rate limits, privacy, or refusals. Will pay for itself with a small team in a few months. I mostly work on custom from scratch Linux operating systems and
307.
by lrvick 4mo ago
I once had a VC ask to meet my founders and I for his morning breakfast at a run down diner in texas. So we fly out from Florida pitch deck in hand, and meet him at his booth. We pull out the deck, he says "Do not need that. How many p
308.
by lrvick 4mo ago
This is madness. I bought my daily driver GPUs for $3k, and they run often 24/7 solving complex bugs and problems for me that would have previously taken months to fix. No rate limits, no censorship or refusal to work on security issue
309.
by lrvick 5mo ago
So 0.1% of the internet is protected by Ed25519 signatures because of this move. Meanwhile PGP has had Ed25519 support for years, with hardware security key support. OpenBSD does fantastic work, but you and I both know it will never have an
310.
by lrvick 5mo ago
At this point I can only conclude you are a troll, but if you are actually serious, I challenge you to prove it. I put in the work in the community for my side of this debate. I would suggest you pick one of the mainline Linux distros that
311.
by lrvick 5mo ago
> PGP is a bunch of theatre there and distros should use minisign instead. Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake
312.
by lrvick 5mo ago
I could name a few off the top of my head, some of which have audited my teams work, but I do not want to put specific people on blast. Most cryptographers I know tend to prefer math to internet controversy and I do not blame them. That sai
313.
by lrvick 5mo ago
So you are saying that the solution is that we go to the majority of active and reputable PGP keyholders, Linux maintainers, and tell them to stop signing the binaries that run the internet, and just yolo, because that worked so well for NP
314.
by lrvick 5mo ago
Ah yes. That post. People send it to me all the time. It is my favorite. It proposes that dissidents and security researchers from all countries from a wide range of backgrounds and beliefs on privacy, should all just accept the terms of se
315.
by lrvick 5mo ago
> Is your pitch that the people who call out problems with PGP don’t have suggested replacements for workflows? Yep. I have read every single blog post I can find from critics. Most several times. As have most people that work on this st
316.
by lrvick 5mo ago
They are compatible enough. It is a firefox vs internet explorer situation. If you want to use shiny new ciphers, expect to have limited reach to those on legacy tools. Tradeoffs each user can make for themselves. That is not an OpenPGP pro
317.
by lrvick 5mo ago
New software that is compatible with any keys generated with good-enough ciphers from the last decade. Compatibility wins. If we are going to play the appeal to authority game, I could just as easily challenge you to find any willing to pub
318.
by lrvick 5mo ago
GnuPG is not the final say for PGP any more than IE6 was the final say for the web. Migrating off IE6 took a while and so will migrating legacy systems off GnuPG. New users of PGP are thankfully mostly using new gen reasonably secure tools.
319.
by lrvick 5mo ago
And none of the back seat drivers ever have alternatives to suggest that solve the same problems while having bothered to endure the IETF standardization process, and thus PGP will continue to be the trust foundation of the software supply
320.
by lrvick 5mo ago
Where even to begin. A renewed IETF working group that aggressively deprecated legacy ciphers and mandated modern ones with optional PQ crypto support (RFC 9580). Lots of actively developed rust implementations like rPGP, rsop, rpgpie, sequ
321.
by lrvick 5mo ago
Well, it is working as intended, right now, and the binaries running on the servers we are communicating with right now were likely signed and validated with Linux maintainer PGP keys because it is the only standard and decentralized option
322.
by lrvick 5mo ago
And yet many of the highest risk systems that exist, the whole foundation of the internet, several governments, major corporations, and thousands of high risk individuals rely on it because centralized options will never be agreed to by all
323.
by lrvick 5mo ago
But Linux distributions are made of people.
324.
by lrvick 5mo ago
When you sign a key you pick a trust level. If no one reputable has ever trusted a persons key with a higher level than "human", then that key should be subject to significantly higher scrutiny. If you look at my key, you will fin
325.
by lrvick 5mo ago
If you can manipulate dozens of Linux maintainers to sign a key maliciously, we have bigger problems. Like a complete failure of the internet. Decentralized human trust, or centralized corporate trust. Pick one.
326.
by lrvick 5mo ago
It is unuseful to people with threat models that allow for entrusting their social graph to centralized identity systems managed by centrally controlled software supply chains that any compromised insider could manipulate. For me and thousa
327.
by lrvick 5mo ago
I am not saying it is not a problem worth solving. I am actually saying PGP actually solves the problem of which key actually belongs to which person. There are dozens of keys claiming to be Torvalds that lack credible endorsements from hig
328.
by lrvick 5mo ago
Because this is too expensive to scale, and people talk in small circles about who has signed who. Good luck inventing thousands of fake identities with a long trust history and reputation with this approach. Botmasters like situations wher
329.
by lrvick 5mo ago
> PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. Or between total strangers that met in person at a key signing party and
330.
by lrvick 5mo ago
You should only be signing other peoples keys with your master key which should never touch an internet connected operating system. Subkeys should have limited privileges and be easy to lose or rotate as needed, but can all live under the s

More ›