LeBit

I think he wants a machine that can do local LLM

Having a VPS gives you a static, non-shared, stable IP with a whois that doesn’t resolve to a residential ISP.

Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.

In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.

It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.

Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?

No need for MITM.

DPI immediately can tell it is ssh.

"Naive”. How ironic.

You use ssh to manage a multi node VPN?

You shouldn’t open a port on your router.

Connect from your home to a public VPS and connect your public devices to that VPS.

I used Nebula extensively.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.

No.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard.

Wireguard is the building block for higher level tools like Tailscale to build on.

Doing ssh through port 80 or 53 or 443 is immediately flagged.

I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https

I work in a unioned environment. I use AI.

My boss would never dream asking I crank more because I now have AI help.

That guy saying there were only two possible outcomes doesn’t know about the beauty of unions.

Far from every comments.

There’s a lot of yous…

You were satisfied with the level of understanding the person you replied to provided.

That person was then politely told to rtfa and given more substance than they thought was in there.

And what did you do?

That’s quite ironic.

And if residents are saying they are driven crazy by the constant horns, forget about them. They don’t matter. Remember: only you matter.

Why aren’t you sandboxing your agent?

Will TOR be blocked?

I am Canadian.

I think this bill is absolutely horrible.

What do you want me to do?

I too use (multiple) yubikey to hold my private gpg keys.

But I am not sure I will stick with gpg though.

Even with my system to extend their expiration or renew them. I have found handling them to be a pain.

I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits.

Gopass now has more than decent age support. A yubikey can hold an age key.

Most git forges accept a ssh key to sign commits. A yubikey can hold a ssh key.

So, for my needs, I think I could leave the operational complexities (to me) of gpg and go for alternatives that are simpler.

Open Weights models will be seeded like movies.

Careful. You will be flagged.

Yeah, it is a regression IMO.

You need to run it with —standalone to properly sandbox it.

Those tools should be designed to be sandboxed.

4/20. It is to Musk what 67 is to children.

I work in IT and I am still surprised by how few of us are passionate about what we do.

90% of my colleagues use Microsoft Edge without extensions.

Other browsers are seen as exotic.

The billions diverted from the government (tariffs, Venezuelian oil, etc) to enrich his own family and friends probably won’t make a dent in the American economy.

America is so great , it can sustain the appetite of corrupt presidencies.

I thought Yandex was taken out

Keep Ass XC? Is it a fork?

On my work laptop I made the lazy/naive mistake of mounting my projects from macOS into devcontainers running in Colima.

vscode extensions using ripgrep in parallel in the background (there are many!) are killing the vm.

I now decided to follow Mitchell Hashimoto choice and use VMware Fusion and simply do all my work inside of it.

Said the mad man

It does look nice and easy.

Not sure I will give up on smolvm though.

I have scripts to launch an instance per task. Nono wraps my coding agent.

I provide the git clone for the specific task.

It works really well.

There is also GLM 5.3 Flash