Telling people not to do something with no compelling explanation will surely increase the odds of people doing that thing. Honestly, the better strategy would be to say nothing.

Electron apps are bloated in terms of disk and memory usage.

Presumably the rust version will be faster and leaner.

Ownership is a big problem with VPNs. A bunch of them are owned by the same two or three companies, and those companies are not good.

I really have no idea what to trust nowadays. A few years ago, Mullvad and Proton were the industry darlings, but they BOTH have far-right ties. Mullvad's founder donates to far-right organizations, and Proton's CEO has AI psychosis and doubled down on some ridiculous comments praising Trump.

It really boggles the mind how anyone can purportedly value privacy and also support any far-right politics. Makes me think they're all honeypots.

For mail, a few things I'd look for:

• Standard protocol compatibility (POP/IMAP/JMAP/SMTP) so you can use a client that's not controlled by the service provider.

• Easy E2EE setup with PGP/GPG.

• Custom domain support.

• Email alias support (though this can be done with a third-party service, potentially).

• Server-side filter rules for incoming mail.

Proton and Tuta, for example, fail on point #1. The E2EE promise really doesn't mean a lot when the service provider ultimately controls the client. If they control the client, they could very easily exfiltrate your keys via a backdoor. This can be mitigated with open-source clients and reproducible builds, but if you're using a web client or apps from Google/Apple stores, that's never going to be verifiable.

For VPN:

• No-logs policy.

• Independent audits.

• Port forwarding support.

• Anonymous payment options.

These are not exhaustive lists, just off the top of my head.

Who are you callin' fancy, cowboy?!

I'm offended!

:P

Well TIL.

I've been lied to all my life!

Although come to think of it, I'm still not sure the timing is the same. When you run at "low" power, is it cycles of like 1-5 seconds, or more like 15-60?

My microwave has a bunch of different modes. Most of them are a bit more complex than "run at X power for Y seconds". Like, the "defrost" or "potato" settings (yes there is a "potato" setting) will cycle the power on and off in bursts, which gives you more even defrosting and less explosive potatoes.

Generative AI or not

It must be. It looks very morged.

I could believe an AI made the template and the text was pasted in. That would explain the misaligned purple underline.

Right. You can still put that through a linter; the linter just wouldn't be concerned with human-readability.

In any case, my editor would not hardcode my display preferences, so if I open and save a document, nothing changes except what I actually changed.

I'll go a step further: formatting for human-readability is the job of the reader, not the writer. Hardcoded line breaks, spacing, etc. are never going to be a good solution because the idea is wrong from the start. This is a display issue, not a logic issue. It needs to be solved at the display end.

Use a syntax-aware editor that formats code the way you like it. Save it any goddamn way that is syntactically valid. Anyone else who opens it will see it any way the like in their own syntax-aware editor.

"But my editor doesn't do logical formatting!" Yes, because the entire world has been insane for several decades, and shitty editors are normalized. If the world had realized this 30 years ago, there wouldn't be a code editor in existence today that didn't do this properly. Demand better and better will be normalized.

Yeah. The burden is high, though, and it's outside even most tech-savvy admins' scope of knowledge.

I mean, I could not tell you off the top of my head how many certificate stores exist on my system and what uses each of them. Is curl safe? Is dnf safe? apt-get? zypper? pip? npm? homebrew? flatpak? Do any of my umpteen Flatpak apps have vulnerable library versions baked in? Do Electron apps bundle their own certificate stores? What about that has its own built-in autoupdater (less of a problem on Linux than Mac or Windows, but still)?

I think the big takeaway here is that if you're using Tor, or a VPN, or really the internet in general, you always need to think about MITM attacks. There are a lot of standard protections against exactly this kind of attack.

...users who ignored warnings that the SSH host key had changed...

SSH keys are one of those protections. Don't ignore the warnings. That's a big red flashing DANGER sign.

...block ports ... used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections...

TLS connections are another of those protections; don't use apps or services that allow plaintext communication.

I'd be interested to know which email clients will downgrade connections by default. That is an absolutely insane thing to do. I don't think my email provider even accepts unencrypted connections anymore.

This is scary but really, nobody's supposed to trust Tor exit nodes in the first place. This doesn't drastically change my comfort level with Tor. But it's a good reminder that you need to be mindful of how your apps are configured.

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

It's hard to properly describe how big a fuckup this is. All I will say is that all the coverage I've seen is underselling the potential for harm. There's nothing you can do except update your shit, pray that everyone in the upstream supply chain of every service you use has updated their shit, and take comfort in the fact that there are no proven wild exploits out there (yet).

I'm not aware of any realistic way to vet published model weights like that.

It works for some open-source software, because you can download the source and compile it yourself. But most of the "open" models don't publish their entire training set, or enough details on the training for it to be truly reproducible. DeepSeek doesn't publish their data sets, and they probably couldn't, legally, since they "collaborate with third-party data providers to obtain proprietary datasets". And even if they did, it would be prohibitively expensive to train it on your own, unlike simply compiling open-source code.

The actual code for training LLMs is relatively trivial. The secret sauce is the training data and fine-tuning.

It's still a risk. You can train an LLM to respond maliciously to a very narrow range of requests that would not be easy to spot in general testing. If you know how the LLM is used, you can target that very specifically. It doesn't have to be as blatant as "always deny the Tiananmen Square massacre ever happened".

Given how thoughtlessly people use AI, and how opaque some of the systems are, I think this is a legitimate concern.

And yes, every government outside America should ban the use of ChatGPT and Claude. Obviously.

Yes and yes.

I don't think TikTok is really comparable though, unless there are somehow people using it for important government work.

Honestly, reasonable.

I mean, I sure don't trust OpenAI or Anthropic any more than I trust DeepSeek, but that's because I don't have legal control over them. The US government does, and it is correct to ban tools that are controlled by adversaries.

No problem until they make every other method more and more difficult. Which is already happening.

I only use passkeys when the alternative is an onerous song and dance.

I mean in great volume. I know AI video generation exists, but it's not very common compared to text, images, or music.

Just wait til AI video catches on.

If we're lucky it will also come with an improvement in video compression. But probably not, and new video codecs typically take 5-10 years to catch on anyway.