[–] 1 point 2 weeks ago*

WebPKI (the term for certificates used for web browser as opposed to the general usage of certificates outside of the web) requires that all certificates now be included in a public, widely used certificate transparency log. That fact gets included in the certificate delivered to your browser. Your browser will reject any certificate* that was not included in a certificate transparency log.

Take your instance discuss.tchncs.de for example, we can see all the certificates here. If you looked at that list, do you see anything wrong? Probably not.

But you're on to something. A malicious certificate is minted and it's in the CT log, so what? I don't check the CT log every time I go to a new webpage. Instead, CT logs are more able giving information to security organizations and companies to detect violations under their own properties. A company like amazon or google would setup CT log monitors to continually monitor for certificates issued for their domains. If they detect one, and they didn't request it, they can flag it to the cert authority board and it can get CAs pulled from the root trust stores. I can (and probably should find time to) setup certspotter on my own domains.

  • source
  • parent
  • context
  • [–] 15 points 3 weeks ago (4 children)

    It means they release the model so you can run it yourself with enough hardware. Kind of like open source. Governments and large companies should be self-hosting this kind of stuff because of security, availability, and IP-leak risks anyway.

    With LLMs, there is some risk of hidden malicious actions embedded in the weights that you can see until you ask it a magic question and it says "activate skynet."

    Whether or not the government is doing this because of fears of hidden actions in the weights or just because OpenAI/Anthropic CEOs told the government to give them more money is unclear.

  • source
  • parent
  • context
  • [–] 3 points 3 weeks ago

    Yes, I run Ollama on a NVIDIA 1080 Ti at home. I run granite4:3b for my Home Assistant assistant for my voice assistant, paperless-ngx, OpenWebUI for chat, and a few other things. For speech to text, I run a custom-built hybrid speech-to-phrase + parakeetTTS (requests that match speech-to-phrase take priority over parakeet.) I run GOModel to route requests to my local Ollama instance, or DeepInfra (cloud-based for larger models), or Tinfoil (cloud-based for encrypted LLM chats.)

    As much as I love to use local-everything, only my smarthome+basic chats go local. Trying to fit both the STT and LLM models on the same GPU at the same time while also using this computer as a media console is challenging. I've recently started looking at the Hailo m.2 accelerator board to see if I can shift the STT to it.

  • source
  •  

    Birdnet-go is a real-time sound analyzer that detects bird species. It can take in audio from microphones. I set mine up to stream audio from my security cameras that I already had installed. There's even a Home Assistant App, if you're using it.

    I live in a more suburban/semi-urban environment, but was really surprised to so many different bird species.

     

    I have Forgejo working pretty well. I also have a Forgejo runner running workflows successfully using a Docker-in-Docker system running in Kubernetes. This works pretty well and I like it, but I'm starting to run into some challenges with more advanced workflow use-cases.

    For example, I only have one runner so jobs stack up. I wasn't sure how to implement multiple runners given that each runner needs to save a static token. I saw some references to ephemeral runners. Does anybody use auto-scaling or multiple-instances such as with ephemeral runners?

    Additionally, using docker-in-docker has some issues. The Docker daemon gets persisted across jobs so the output images stack up and I have to periodically run docker system prune inside the runner. Trying to run docker commands that require logging in inside the workflow also conflicts with Forgejo's own control of the Docker Daemon.

    Does anybody else run into these kinds of issues and have a good strategy? There was this issue about using firecracker micro-vms which could have fixed the d-in-d issues, but no recent updates.

    view more: next ›