airhangerf15

You must be fun at parties.

..I laughed.

GLM-5.x and Kimi 3.x are good open weight models. In theory one could run them locally if the prices of the DGX/Halos ever come back down (you use to be able to run them on ~$20k worth of hardware, but now it looks like you need $40k worth of hardware after all the recent price jumps. Gorgon Halo and newer memory offloading techniques might change that).

With OpenCode you can run /model and just select whatever your provider offers. I always recommend not using prompts. Create an AGENT.md with your project rules, then create a plan/01-initial-requirements.md. Write an entire requirements spec. Commit those. Then tell the LLM "Read AGENT.md for project rules and run plan/01-initial-requirements.md".

That way you can commit that output on a branch, jump back to the original commit, and run the plan again with a different model. You can do that multiple times and compare the output on all the branches. Some models might give you better UI, some better structure. You can just keep the one you like most, or ask a model to combine certain aspects of each branch into your final.

Your terminology is a bit wrong. "Claude Code" has no "weights." It's a harness. It contacts Anthropic servers and runs their closed weight models.

The harness provides a means for the LLM to write file output and run tools (commands) to test output. Alternative harnesses including things like OpenCode.

You can point OpenCode to your Anthropic account, but only if you have API usage (there are ways around this, but if Anthropic detects it you could get banned). Anthropic locks their subscription plans to THEIR harness and no others.

Most harnesses like OpenCode, Cursor, Pi, Hermes, etc. have settings to tie into a bunch of different providers (although they'll always try to promote their own by default, because they have to fund their own harness development of course).

I recommend OpenCode + OpenRouter. OpenRouter has a bunch of models and their web interface shows where those models are run (AWS Bedrock, xAI, Anthropic, etc.) and what data they collect from your prompts (although this is kinda a 'trust me bro' status as a provider could be lying about collecting data).

Sorry DKMS. nvidia distributes closed source .o files and most distributes have dkms packages to build those for each kernel.

> Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?

On any Linux distribution, which managed packages update themselves? zero. Crowdstrike should provide package repositories so admins can pull in updates at their regular cadence.

At a minimum, the package should NEVER update its own binaries located in /usr/bin or /opt. If it need to pull updates, those should go in /var. Crowdstrike could have made the core binaries a shim where they load a second stage from /var.

I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.

Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.

I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.

VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.

It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?

Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.

Pleroma