CPU and memory are not the only concerns, file system and network access are dangerous as well, and they tend to be less instrumented in terms of hardware isolation.
I do it like this, but on one computer, using QEMU. I have 3 different VMs for - development & AI tools - infra rollouts - banking / other sensitive services I have Steam Deck for gaming, and do most of casual web…
I think gp meant DKMS (https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support). It allows for things like using same proprietary device drivers across many Linux kernels.
The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology…
To anyone who might be reading this exchange, actually there is recently added builtin setting for delayed auto-update, `extensions.autoUpdateDelay`, see https://github.com/microsoft/vscode/issues/316867 and…
Thanks for correction!
Boris: "By winter 2025, 100 percent of my code was written by Claude Code. Not a single line by hand." Igor Kofman: "I do not write any code by myself anymore." Turns out if you are not writing the code, then North…
Wow, great notion about using git remote to transfer source from the agent host. I already use ssh into VM to transfer the files like designs for sharing, so going to adopt your approach right now :)
Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use…
I only use agentic development tools in qemu VM that has no production access or host shared folders, and the only secrets there are development. I still have my Git ssh key there, but I never use ssh agent to load the…
There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it.…
Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were…
Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and…
It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX…
Nah it was Anthropic, see my comment at https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under…
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to…
The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of…
The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw…
Ukraine uses Starshield, which is paid by Germany (with current contract ending in April 2027). What you describe in regards to chip hacking so it reports location as static, it is how nazi invaders got it working in a…
I wonder if Web, WebPKI and some other global network infrastructure are a sign of the emerging internationalist, stateless order ahead of us. Might be a hot topic on next Joe Rogan show :)
Just saw your comment, thanks, not sure if putins regime can be met with anything but hatred, and not only because of its treatment of Ukrainians, but also many Russians are as well victims of nazi kgb regime in direct…
Previously such incidents have lead to the CA business cessation by the involved entities (e.g. Diginotar case). I dont see how it would be different in this case.
Yeah, I have extensive collection of prompts for reviews and usually run 3-5 (automated) review takes on large sets of changes before doing eyeball reviews. Auto reviews indeed find many obvious bugs, but they usually…
> Whereas if you're handing off all dev and no longer reading code, just making CTO-level architecture decisions, then there are only 2~3 models right now worth using, none cheap. I use frontier models every day and…
The right only cares about wellbeing of the rich, and is usually keen to exploit the demographic majority in the interest of the few (see what is happening in US now). I follow politics of democratic countries closely…
CPU and memory are not the only concerns, file system and network access are dangerous as well, and they tend to be less instrumented in terms of hardware isolation.
I do it like this, but on one computer, using QEMU. I have 3 different VMs for - development & AI tools - infra rollouts - banking / other sensitive services I have Steam Deck for gaming, and do most of casual web…
I think gp meant DKMS (https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support). It allows for things like using same proprietary device drivers across many Linux kernels.
The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology…
To anyone who might be reading this exchange, actually there is recently added builtin setting for delayed auto-update, `extensions.autoUpdateDelay`, see https://github.com/microsoft/vscode/issues/316867 and…
Thanks for correction!
Boris: "By winter 2025, 100 percent of my code was written by Claude Code. Not a single line by hand." Igor Kofman: "I do not write any code by myself anymore." Turns out if you are not writing the code, then North…
Wow, great notion about using git remote to transfer source from the agent host. I already use ssh into VM to transfer the files like designs for sharing, so going to adopt your approach right now :)
Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use…
I only use agentic development tools in qemu VM that has no production access or host shared folders, and the only secrets there are development. I still have my Git ssh key there, but I never use ssh agent to load the…
There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it.…
Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were…
Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and…
It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX…
Nah it was Anthropic, see my comment at https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under…
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to…
The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of…
The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw…
Ukraine uses Starshield, which is paid by Germany (with current contract ending in April 2027). What you describe in regards to chip hacking so it reports location as static, it is how nazi invaders got it working in a…
I wonder if Web, WebPKI and some other global network infrastructure are a sign of the emerging internationalist, stateless order ahead of us. Might be a hot topic on next Joe Rogan show :)
Just saw your comment, thanks, not sure if putins regime can be met with anything but hatred, and not only because of its treatment of Ukrainians, but also many Russians are as well victims of nazi kgb regime in direct…
Previously such incidents have lead to the CA business cessation by the involved entities (e.g. Diginotar case). I dont see how it would be different in this case.
Yeah, I have extensive collection of prompts for reviews and usually run 3-5 (automated) review takes on large sets of changes before doing eyeball reviews. Auto reviews indeed find many obvious bugs, but they usually…
> Whereas if you're handing off all dev and no longer reading code, just making CTO-level architecture decisions, then there are only 2~3 models right now worth using, none cheap. I use frontier models every day and…
The right only cares about wellbeing of the rich, and is usually keen to exploit the demographic majority in the interest of the few (see what is happening in US now). I follow politics of democratic countries closely…