lrvick

23 ms·

361.
by lrvick 6mo ago
I did for over a decade, but it does not go far enough with supply chain security. I bootstrapped a new generation of Linux distribution from 180 bytes of human readable x86 machine code all the way up. https://stagex.tools
362.
by lrvick 6mo ago
pnpm is even worse. There is no way to bootstrap it without binary blobs making it an easy target supply chain attack waiting to happen that could hide in plain sight indefinitely.
363.
by lrvick 6mo ago
https://en.wikipedia.org/wiki/Source_lines_of_code
364.
by lrvick 6mo ago
> Roads, road names, traffic restrictions - pretty much every part of it is chaotic and incredibly hard to put together without a GPS on a digital map. If digital maps on GPS know about directions, then so does the internet, and the dire
365.
by lrvick 6mo ago
Let me make you aware of zerodium. A broker anyone can sell vulns to, that sells to unspecified buyers you do not need to know about.
366.
by lrvick 6mo ago
Anyone can sell a vuln in any jurisdiction and never be caught. Lets not pretend the law is actually worth a damn here. We need an anonymous bounty system.
367.
by lrvick 6mo ago
Unfortunately this is correct. As a security researcher I set millions in profit on fire for reporting vulns to projects that offer no bounties vs selling to highest bidder. I keep doing it because it is the right thing to do, but I would n
368.
by lrvick 6mo ago
Was not disclosed to stagex, and I expect a lot of linux distros. Thankfully we were already on kernel 7.0 so not impacted
369.
by lrvick 6mo ago
see my reply to sibling comment
370.
by lrvick 6mo ago
I do own android devices for development and testing, but I do not have a cell phone plan and I do not carry any electronics when leaving home unless my explicit goal is working away from home, in which case I bring a laptop.
371.
by lrvick 6mo ago
reproducible builds, ideally. f-droid supports this.
372.
by lrvick 6mo ago
First thing is nuke tap to pay. That is surveillance capitalism dependence masquerading as convenience. Step one, and I am serious, is just use cash. Every time you pay with cash at a drug store, a liquer store, a casino, donation boxes, cl
373.
by lrvick 6mo ago
It is actually a perfectly practical choice to completely ignore those ecosystems. I am the founder and active engineer at two companies and two large open source projects and have a family, travel a lot, and have an active social life in S
374.
by lrvick 6mo ago
If someone can push nonconsensual updates to your device then you never owned it in the first place.
375.
by lrvick 6mo ago
There is such a thing. FOSS.
376.
by lrvick 6mo ago
Whenever NPM is offline, the internet is a little safer. Keep up the good work Microsoft. Let's shoot for 100% downtime though. Thanks.
377.
by lrvick 6mo ago
Corpos tend to be on Github, where community focused projects are very rapidly shifting to codeberg, which is fully open source and also has commit signing integration that actually works.
378.
by lrvick 6mo ago
Every time Github goes down, a few more people move to ethical alternatives and reduce the FOSS community having a SPOF in Microsoft. https://sfconservancy.org/GiveUpGitHub/
379.
by lrvick 6mo ago
> We will resist the potential of this technology to consolidate power in the hands of the few. FOSS || GTFO
380.
by lrvick 6mo ago
The maintainer of the OSS fork being the company does not matter to me. Their product is proprietary now which means they are no longer worth giving money too. I only pay for hosted software that gives me the freedom to easily leave and los
381.
by lrvick 6mo ago
My use cases requires sovereignty with all data on my property, offline use, and the ability to customize models to let me do security research without refusals. Anthropic and OpenAI have nothing to offer people like me that require freedom
382.
by lrvick 6mo ago
Closed source software has no value anymore. If I like your UX and it is proprietary, I will just ask an LLM to clone it. I would only pay for something open knowing I have the freedom to self host if I ever need to.
383.
by lrvick 6mo ago
Not only are they good at reading and writing machine code now, they are actively being used to turn video game cartridge dumps back into open source code the community can then compile for modern platforms. There is no moat anymore.
384.
by lrvick 6mo ago
As a former cal.com advocate, I am now going to be switching my two companies to cal.diy or a similar alternative and canceling my cal.com subscriptions. I am now actively rooting for cal.com to go out of business now as a cautionary tale f
385.
by lrvick 6mo ago
35t/s on Qwen3.5 122b on a Strix Halo. The local stuff works great now. Stop giving the corpo monopolists money.
386.
by lrvick 6mo ago
Obviously, and that is no different than remote models. You do not and should not ever trust an LLM, but with proper handling they can still be super useful. You give LLMs a dedicated OS to work in, let them do research or debugging and com
387.
by lrvick 6mo ago
I do linux kernel, compiler, and operating system dev with Qwen3.5 122b running locally on a Strix Halo 128G ad 35t/s. Pretty much the most complex software problems one can work on. I think a lot of people just want to put in a credit
388.
by lrvick 6mo ago
Burn baby burn. Meanwhile, you can always buy hardware like a Strix Halo and have local LLMs that no third party can take away from you.
389.
by lrvick 6mo ago
Indeed. The bottom 90% of white collar work as it exists today is probably gone over the next decade.
390.
by lrvick 6mo ago
Vision language models are quite good at solving captchas now :)

More ›