You may be able to find me on other platforms by the same name!
Mastodon: specialwall@woof.tech
Contact me on SimpleX or Signal!
Now, EPFL researchers… have released new software that allows users to download open-source AI models and use them locally, with no need for the cloud to answer questions or complete tasks.
It’s cool that they got LLMs running on local clusters of computers, but with the way it’s written, they make it sound like people have not already been using local LLMs for a long time (including GPT-OSS 120B).
The safest way would be to get AppVerifier and check the original developer’s signature
It’s important to note that the Vivaldi browser is proprietary software
Okay. Well, in this case it would probably be a good idea to at least have the update process also verify developer signatures, since otherwise it’s not only trust on first visit, but trust every update.
And yeah, I agree that a standalone package might be a good solution, as long as it is signed.
If the user trusts the server to serve safe JavaScript each time they connect with an empty cache (which is cleared often for privacy-conscious users), I’m not sure how this adopts a very different security posture from the Trust On First Use security model that’s used by many other apps, even if the app itself implements secure MITM mitigations using data from shared links.
When you have an app with dedicated updates, it is possible to verify that it is genuinely from the developer or maintainer. Web browsers’ certificate validation protects against connecting to a fake server, but it does not protect the user if the server is compromised when they first connect.
The most security-conscious users are going to end up hosting the JavaScript in a webserver on localhost, and at that point it might as well be a dedicated application.
Removed by mod
What’s the alternative? Keeping Nicolás Maduro in charge?
Yeah, any authentication cookie will be unique to you, so if you do use one, Google will be able to track you across browsing sessions, which is likely what you’re trying to mitigate by clearing them.
There are extensions that let you encrypt/decrypt messages right in your Gmail inbox. I’m not sure whether that would let Google grab the decrypted messages using JavaScript, though.
It’s news to me that you can’t connect to a proxy over a VPN.
I don’t know why there’s a need to use outdated symbols here.
If you don’t use Tor: https://www.privacyguides.org/en/
There are going to be more services you need than http and https. You’ll also need to allow DNS queries and a way to keep your time updated, for instance.
The advantage of blocking incoming connections is that each potentially vulnerable network service isn’t automatically exposed to the internet. Blocking outgoing connections isn’t going to improve your security much, considering that any compromised service trying to phone home could just use http, the same protocol your browser uses.
It would still matter that your OS isn’t up to date. For instance, if there is ever a vulnerability in the way Windows 10 renders an image format that allows remote code execution, Microsoft will not give you a patch.
If you must remain on Windows 10, the best way to reduce attack surface is going to be to uninstall as much software as possible that you don’t use.
If you only use a browser, then you could have a quite seemless transition to Linux. That way you can have an up-to-date system. The vast majority of browsers support it natively, including Chrome and Edge.
Language models don’t have any “mind”. No matter how far this goes, current methods (making more and more advanced LLMs) can’t lead to a “superintelligence” or even any kind of real reasoning.
De-Googled forks of Android would have just reversed that limitation
Here’s hoping GrapheneOS decides to support it! 🤞
What specifically do you think is hard to avoid? I’ve never accidentally triggered a quick answer, personally
Paying for Yandex APIs is a product of their goal to be the best search engine available. They pay for access to nearly every major search provider and wouldn’t want to lose access to Yandex results just because of the country they’re located in.
Personally, it’s the only search engine I haven’t wanted to get away from
This depends whether you care about security or software freedom guarantees. Because if it’s security that is the priority, F-Droid is a much weaker option than Obtanium+Appverifier because they use their own signing keys for nearly all apps. If F-Droid’s build infrastructure is ever compromised, then almost every app you have downloaded through it is also compromised. The inability for developers to control their own signatures is part of the reason Signal does not release on F-Droid.
Accrescent is a much better option than anything else because it still allows developer-managed keys, although it doesn’t have many apps. Google Play (although it does have high-security infrastructure) has the same problem as F-Droid of centrally managed keys. Obtanium with Appverifier at least lets you ensure that your app is signed by the developer.