Continued thread
I met one single Qubes user. I think we are friends now.
Lance R. Vick
FOSS || GTFO
* Security Engineer
* Cypherpunk
* Founder of #! (hashbang.sh), stagex.tools
* Co-founder of Distrust.co, Caution.co
* Church Of Cryptography Priest
#infosec #security #opensource #foss #sysadmin #cryptoanarchy #cypherpunk #embedded #puzzles #privacy #locksport #programming #linux #homelab
- OpenPGP
- openpgp4fpr:6B61ECD76088748C70590D55E90A401336C8AAA9
- Matrix
- @lrvick:matrix.org
- Resume
- https://lance.dev
- Community
- https://hashbang.sh
At the biggest Linux conference in the country right now.
Still not seen a single Linux laptop other than at the Framework booth, and the one in front of me I am using to type this.
That tells you pretty much everything you need to know about US tech culture.
It is interesting that seemingly every single one of the security celebs advocating we abandon the PGP Web of Trust that signs most of the binaries that run the internet, has a centralized trust system to sell you.
Twitter is now so useless that even the EFF, who remain willing to be on Tiktok and Facebook still, can't deal with it anymore: https://www.eff.org/deeplinks/2026/04/eff-leaving-x
Electronic Frontier Foundation · EFF is Leaving XAfter almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue.
Lance R. Vick boosted
This is still the Metaverse website, even after announcing Horizon Worlds will be shutting down soon.
Meta didn't need the metaverse to succeed, they needed it to exist long enough to collect your data and keep investors distracted.
Anthropic just legally threatened Opencode to make them drop support: https://web.archive.org/web/20260221041617/https://github.com/anomalyco/opencode-anthropic-auth/pull/15#issuecomment-3930558874
Archive link because they deleted the repo after to comply with demands.
In short, Anthropic only wants you using their official walled-garden clients to access the models trained on our open source code.
They are not a lesser evil. They are just as evil as OpenAI.
Stop giving these assholes money. Rent or buy hardware to self-host with privacy and freedom. It is not that hard, I promise.
GitHubfix: Align Anthropic OAuth requests with Claude Code by deveworld · Pull Request #15 · anomalyco/opencode-anthropic-auth
AI automated security review company that views human code review as unnecessary, gets hit by supply chain attack that their automation failed to detect. Beautiful.
How many more of these are required before we can seriously talk about Web of Trust, commit signing, and decentralized crowd-sourced FOSS code review?
www.sysdig.comTeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions | SysdigThe Sysdig Threat Reseaarch Team (TRT) reveals how TeamPCP’s supply chain attack spread from Trivy to Checkmarx, reusing stolen CI/CD credentials to compromise GitHub Actions and evade traditional detection.
Lance R. Vick<p>Read more about our work on [Stageˣ] here: <a href="https://stagex.tools" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">stagex.tools</span><span class="invisible"></span></a></p><p>All the pain of supply chain attacks is self inflicted. We actually can fix this.</p>
Lance R. Vick<p>Security celebrities have been shitting on the PGP Web Of Trust as an idea we should abandon in favor of centralizing trust on corpos.</p><p>Meanwhile the internet is filling with AI bots using fake corpo accounts and no one can tell who is human anymore. Huh.</p><p>WoT has never mattered more, and it is time we anchor modern tooling back to the human roots that built the internet.</p><p>My fellow [Stageˣ] maintainer Kron, Zoë Finja Emilia makes a strong visual case.</p><p><a href="https://kron.fi/en/posts/stagex-web-of-trust/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">kron.fi/en/posts/stagex-web-of</span><span class="invisible">-trust/</span></a></p>
Lance R. Vick<p>As the founder of the Stagex Linux distribution and a California resident, my official position on operating system age verification mandates is that I personally will not implement it, and I doubt anyone else will.</p><p>Our decentralized and multi-party cryptographic signing design means no single person or entity has the power to make changes to the distribution alone.</p><p>But please, California lawmakers, try to make me. I would get off on making you look like idiots in court.</p><p>That is all.</p>
Lance R. Vick<p>If anyone would like to tip me for my work, I accept DDR5 memory.</p>
Lance R. Vick<p>Veritasium just dropped a video on ethics of the FOSS movement, right to repair, digital sovereignty, and the idea that closed source software has absolutely no role in supply chain security.</p><p>In recent years my teammates and I have shifted our entire careers to FOSS supply chain security engineering in spite of constantly being told our work is a waste of time. We feel seen!</p><p><a href="https://yewtu.be/watch?v=aoag03mSuXQ" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">yewtu.be/watch?v=aoag03mSuXQ</span><span class="invisible"></span></a></p><p>Shameless plugs @ <a href="https://caution.co" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">caution.co</span><span class="invisible"></span></a> <a href="https://distrust.co" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">distrust.co</span><span class="invisible"></span></a> and <a href="https://stagex.tools" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">stagex.tools</span><span class="invisible"></span></a></p>
Lance R. Vick<p>I wonder if there were people that thought Stallman was a bad person for using a proprietary compiler to build the first version of GCC.</p><p>I exclusively write FOSS, but sometimes I don't understand the purity tests of the FOSS community.</p><p>As long as a PR author fully read the the code, and it was not largely copied from any other project, I don't care what kind of autocomplete magic was used.</p><p>FOSS is at too big of a disadvantage to be picky about useful contributions that respect the license.</p>
Lance R. Vick<p>When you work on OS development, you spend a -lot- of time waiting on compiling experiments. Wasted time.</p><p>So, finally broke down on a big workstation upgrade:</p>
Lance R. Vick<p>So I trained an LLM on myself, and it sounded like a complete idiot so I deleted it immediately.</p><p>I am starting to consider that it might be a me problem.</p>
Lance R. Vick<p>The biggest life lesson I have internalized this year:</p><p>The greatest skill in the world without sufficient motivation as a catalyst can accomplish nothing, but with enough motivation one can pick up just enough skills as they go to accomplish almost anything.</p>
Lance R. Vick<p>An insane amount of personal data is getting routed to proprietary LLM providers directly and indirectly.</p><p>Worse, all that personal data is going to get used to sit on the scales of otherwise "fair" weights to produce an entirely new form of toxic and manipulative targeted advertising.</p><p>Since we can't un-invent LLMs, the way forward is to make sure they exist with provable privacy and integrity.</p><p>We just released the first FOSS stack to do exactly that.</p><p><a href="https://caution.co/blog/verifiable-llms.html" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">caution.co/blog/verifiable-llm</span><span class="invisible">s.html</span></a></p>
Lance R. Vick<p>* My views and candor do not necessarily reflect that of the entire stagex team</p>
Lance R. Vick<p>I should wait until this release is published next week, but I am too excited.</p><p>Stagex is the first production ready Linux distro to be:</p><p>- 100% deterministic<br />- 100% full source bootstrapped<br />- Maintainer signed on every commit and review<br />- Reproduced and signed by multiple maintainers on every artifact<br />- OCI container native<br />- LLVM/compiler-rt/libunwind native</p><p><a href="https://codeberg.org/stagex/stagex/pulls/761" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">codeberg.org/stagex/stagex/pul</span><span class="invisible">ls/761</span></a></p><p>All the confs that turned us down and the people who said it could not be done can eat my entire ass.</p>
Lance R. Vick<p>Back on the air now. Will be interesting to see if Marci is back tomorrow.</p><p>On further investigation the station was bought by Audacy, which was bought by CBS, which was bought by Paramount, who is actively censoring anything negative about the Trump administration (Stephen Colebert, etc)</p><p>We will may never know what happened behind the scenes here, but one can hazard a pretty good guess.</p>
Lance R. Vick<p>I was listening to Live 105.3 this morning, easily the most popular radio station in the San Francisco Bay Area.</p><p>I heard the host, Marci Wiser say something close to the following: "I know we are limited in what we can say on the radio, but this has to stop. Regardless of what side you are on in regards to things going on in the world, it is not okay that we are feeling this way."</p><p>And then it went back to some music.</p><p>Shortly after, the station went dark.</p><p><a href="https://www.audacy.com/stations/live105" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://www.</span><span class="">audacy.com/stations/live105</span><span class="invisible"></span></a></p>
Lance R. Vick<p>As an owner of multiple businesses that have to serve a wide client base of diverse views, I normally try to stay a bit apolitical publicly.</p><p>That being said.</p><p>Fuck ICE, and fuck anyone still trying to defend them.</p>
Lance R. Vick<p>I just went down a rabbit hole exploring the Amiga games collection for the first time.</p><p>I am proud to announce that I now identify as a cybergoth.</p>
Lance R. Vick<p>We got our first PC at home when I was maybe 8 years old. My parents told me not to touch it, so I waited until they went to sleep and disassembled it, laying all the parts neatly across the living room floor.</p><p>I made sure they saw that when they woke up.</p><p>"You have two choices. Let me touch it to put it back together and let me use it whenever I want, or this can be your problem"</p><p>They chose the former.</p>
Lance R. Vick<p>The bare minimum for running security critical services is multi-party verified deterministic builds running on remotely attestable enclaves.</p><p>My teammates and I at Distrust have been helping teams architect and build this way for 5+ years now.</p><p>It was tough watching people repeatedly struggle to do everything from zero.</p><p>So we built the first 100% FOSS general purpose verifiable compute platform: Caution.</p><p>For prioritized early access join <a href="https://mastodon.social/tags/caution" class="mention hashtag" rel="tag">#<span>caution</span></a>-platform:matrix.org</p><p><a href="https://caution.co" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">caution.co</span><span class="invisible"></span></a></p>
Lance R. Vick<p>If you claim to be building decentralized FOSS for censorship resistant finance, privacy, or communication and you collaborate via Zoom, Slack, Telegram, Twitter, Github, or Discord: you are full of shit.</p>
Lance R. Vick<p>Hot take: Using nixpkgs in production is negligent.</p>
Lance R. Vick<p>It is downright offensive and laughable that so many crypto founders, which supposedly built their offerings under anti-authority, decentralization, and cypherpunk ethos, continue to bring eyeballs to a centralized heavily censored platforms like Youtube and Twitter that are inherently authoritarian by design.</p><p>This is why I will never post content on Youtube, Twitter, TikTok, etc. </p><p>If you ever see any of my work or content published on proprietary platforms, it was because others put it there.</p>
Lance R. Vick<p>From Google terms of service: "Criticizing, questioning, making objections or complaints about the Service, its staff or anything related to it is prohibited and constitutes a breach of the Terms."</p><p>All I have to say to that is: Fuck Google, their staff, and everything related to them.</p><p>Degoogled my life more than 5 years ago and can strongly recommend.</p><p>Great holiday gift to yourself!</p><p><a href="https://tosdr.org/en/service/217" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">tosdr.org/en/service/217</span><span class="invisible"></span></a></p>
Lance R. Vick<p>k-256^211+99 was an expression published in 2001 by Phil Carmondy that cleverly produced an academically relevant new prime number, which also happened to contain gzipped DeCSS source code needed for copying DVDs making it illegal under DMCA law.</p><p>The expression itself is an intentional tool to aid in copyright circumvention and is also thus illegal.</p><p>If you fail to delete your browser cache right now, you are breaking DMCA copyright law. </p><p>You are welcome.</p>
Lance R. Vick<p>Want to support creators without feeding surveillance capitalism? </p><p>Cancel all streaming services, pirate everything, and use saved cash to buy merch, theater/concert tickets, etc.</p><p>Pros:<br />- gives more money to creators<br />- gives less money to labels, studios, and distributors<br />- gives you a local copy of media you can keep long term<br />- avoids dependency on proprietary software<br />- avoids your activity being sold to advertizers<br />- no ads</p><p>Cons:<br /> - makes shareholders sad</p><p>It's a pirate's life for me.</p>
Lance R. Vick<p>The best thing about the Cloudflare outage is that no software or web services I use were stupid enough to use Cloudflare.</p><p>Watching the proprietary world burn brings me so much joy.</p>
Lance R. Vick<p>Some are trying to convince me that I need to be on Twitter in order to help drive engagement about our security and privacy work.</p><p>It would help me justify continuing to ignore Twitter if I can get significant engagement here.</p><p>Boosts and nonsense replies appreciated!</p>
Lance R. Vick<p>Some idiot company connected toilets with cameras to the internet claiming the media collected of peoples "ends" was end to end encrypted. Except, it wasn't.</p><p>These compromised toilet cams could be easily used to exfiltrate compromising videos of exfiltrations.</p><p>The toilets leak pictures of people taking leaks.</p><p>The internet really is going to shit.</p><p><a href="https://varlogsimon.leaflet.pub/3m6zrw6k2bs2p?interactionDrawer=quotes" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">varlogsimon.leaflet.pub/3m6zrw</span><span class="invisible">6k2bs2p?interactionDrawer=quotes</span></a></p>
Lance R. Vick<p>Quick history lesson.</p><p>In 1920s Italy Mussolini used "anti-fascist" to describe his opponents. Mussolini's secret police was officially known as the "Organization for Vigilance and Repression of Anti-Fascism". Quite literally the Anti-Anti-Fascist police.</p><p>In 1930s Germany the Iron Front anti-fascist party flew three arrows flag.</p><p>In the US anyone peacefully flying that flag is called a terrorist. </p><p>Dictators always fear that message. </p><p>Keep those flags high.</p><p>No Kings. No Masters. No Dictators.</p>
Lance R. Vick<p>So I have a small retro home arcade that takes coins. </p><p>Thing is with coinop games: if you leave them on freeplay, you get unlimited lives and it removes all the challenge and satisfaction.</p><p>Okay so, I leave them all on requiring coins.</p><p>But since I exclusively use cash, I have endless quarters, so switched to tokens.</p><p>But now I need a limitation on tokens.</p><p>So I got a cheap change machine off eBay to exchange cash for tokens. Obviously.</p><p>The change machine might pay for itself?</p>
Lance R. Vick<p>Someone told me today: </p><p>"you will be unlikely to compete with people who use AI tools effectively."</p><p>Challenge accepted.</p>
daniel:// stenberg://<p>Now is another great moment to ponder if making your business rely on Amazon is a great idea.</p>
Lance R. Vick<p>IF you are willing to do the work and research to get your group setup with a very unfamiliar way of remote communication, and work around all the limitations to ensure E2EE is actually working in a useful way.</p>
Lance R. Vick<p>Unfortunately there is no good answer here yet, but we can rule some things out pretty quick.</p><p>Centralized metadata control and client binary control is a non starter, so that rules out Whatsapp, Telegram, Signal, etc.</p><p>It is true Matrix/Element lacks complete metadata protection from the person you choose to run your server, quantum defense, and ideal UX, but it is also still the best option for private chat today if there is any chance you or someone you care about might be targeted, ever.</p>