I don’t have any personal experience with self hosted webmail. I know there are a bunch out there and definitely both options that can sit in front of a maildir and options that can sit in front of a POP/IMAP server like Dovecot.

I did a little googling, and if I wanted to set this up, the first thing I’d check out is something like imapsync -> dovecot -> Roundcube.

Dovecot provides a really reliable maildir -> IMAP/POP conversion layer, and once you’ve got that, most things should work.

You can use imapsync to keep a local synced copy your email in maildir format. That, along with a domain you own, solves the “I own my own email sycned to my server” problem pretty much completely. Switching email providers is just syncing to the new server (which imapsync supports) and updating your MX records on your domain.

Some email clients (like aerc) can just operate on the maildir directly. That’s what I do, but there are lots of ways to do this.

One option is to just keep using your email client the way you are now talking directly to your mailserver, and just rely on the imapsync side to be your owned backup/migration path.

Alternatively you can run your own local IMAP or POP server like Dovecot backed by the local maildir. So that’s imapsync -> dovecot -> thunderbird (or similar). It’s a little more software to set up, but once it’s set up it should be very reliable and gives you total control over what email client you use and full ownership of your data.

Is France… ok?

I’ve always treated my home server with public facing services as presumptively compromised. I don’t put any data on there I wouldn’t want to see become public, and any data I actually care about losing is backed up to the cloud with an append-only key. The NixOS config lives in a git repo not on the server. If something bad happens, I can wipe the machine clean, redeploy the image, restore my backups, and we’re back to the status quo.

So, my threat model hasn’t changed much!

They really want people scared, ehh?

note that you probably need to trust the remote household with your data

Probably not actually. Borgbackup (and any sensible encrypted backup system really), does client side encryption. So the data should be encrypted before it’s even sent down the wire. The remote household shouldn’t be able to access the data without the encryption key/password.

I mean, they will have to trust the remote household not to destroy the data, but that’s pretty much an unavoidable limitation.

You’d better give us money and not try to regulate us.

Actually, right now, the western AI companies desperately want regulation.

An unregulated environment is one where they’re forced to compete on price against the Chinese companies and startups running open-weight models. All signs point to them losing that battle.

OpenAI/Anthropic’s wish list right now is a bunch of regulation to prevent the use of foreign models, and to require expensive to implement “safety” requirements that make it hard for startups to compete.

You absolutely shouldn’t be angry!

The existence of powerful open-weight models is the single thing that’s going to prevent us from descending into the full corporate dystopia everyone’s afraid of.

It’s going to hit the stock market hard once everyone figures out what’s going on though.

[forget]
keep-daily = 10
keep-weekly = 4

Daily backups are cheap because of de-duplication. I keep a few weekly backups in case it takes me a bit to notice something went wrong. I don’t usually back up logs.

I could probably drop the weekly backups without much risk, but I’ve got the space.

So… your evidence for slop is that he made a patch, they caught an issue in the review process, and then he had to go on vacation so he asked another maintainer to take over to get the change done correctly in the merge window?

How is that not the process working exactly as intended?

The hilarious part is, yes, I don’t care how fast my launcher is.

But… also, Steam is by far the slowest, least responsive program on my computer.

“Faster than Steam” feels like a joke.

I don’t use a lot of non-open source applications (and not a lot of desktop applications generally). Have they gotten so bad that the slowness of Steam doesn’t feel bad to people anymore?

I really hate that that comment is getting upvoted.

People love to hate on things a lot more than they like to understand how things actually work.

To make your point more explicit, CEOs often don’t have to sit for depositions because they legitimately aren’t the people who know the facts the cases turn on. When the CEOs are the right ones to talk to, courts don’t hesitate to make them show up.

Don’t get me wrong, I hate big corporations plenty. Don’t get me started about Meta or Microsoft. But can we please hate them for actually good reasons instead of making reasons to hate them up?

the models only need to be right some of the time and they still constitute a threat.

Right!?!

And with how cheap and fast they are to run, they don’t have to be right that often as long as a separate run can verify/validate claims. In a lot of ways what the LLMs do should probably be thought of as just a very sophisticated sort of brute force approach. You’re effectively just searching the space of combinations of known vulnerabilities. It doesn’t require particular cleverness, just an encyclopedic knowledge, a reasonable way to prune the search space, and the ability to put in the compute time.

I must be missing something, because you’re getting a bunch of upvotes. I don’t disagree with anything you said, but it feels like a total non-sequitur to what I was saying.

Yes - proper air-gapping is a good idea. But asking the big AI labs to air gap is kind of pointless. Liability already gives them legal incentives to avoid incidents. If that didn’t stop them, a letter signed by a bunch of academics sure won’t. More importantly, open-weight models capable of doing all the things that we’re concerned about are already in the hands of bad actors around the world.

This letter is asking us to lock the front door of the house when the back wall is missing.

The ones in Russia definitely are. They don’t have to be local models - you run them in the cloud like anyone else.

The idea that the frontier labs have LLMs with special capabilities that make them dramatically better than the top open-weight models is largely marketing.

The reality is that most systems are poorly secured, and LLMs make exploiting vulnerabilities fast, cheap, and easy. What would have taken a trained security researcher weeks before can be done by a much less skilled attacker with an LLM in a few hours.

This is stupid. Open-weight models that can largely do what the OpenAI/Anthropic models did are already out in the wild.

Do these people not understand that you can’t put the cat back in the bag?

Right? This is going to be an interesting story to follow.

On the one hand, they don’t want to IPO right now, probably because they don’t think investors are keen to buy at the price they’re asking.

On the other hand, I don’t really see things getting better for them as long as cheap open-weight models that are almost as good as Anthropic’s exist. As more people figure this out, I think it’s going to get worse not better. So I don’t think they can afford to wait long.

“The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage,” Anthropic explained. “This will enable faster and more frequent scanning, but means that it is possible reports will be incorrect or invalid.”

When I saw the headline, I was wondering about this specifically. This may make this service not super useful.

My experience with AI security reviews is that they’re fantastic at finding faults, but they always find a list of things to complain about. If there are no real/serious faults they’ll start finding things that kind of have the same shape as a security issue, but really aren’t if you dig into them. I’ve regularly had an LLM generate a list of 10-15 issues ranging in severity from “nits” to “critical” where none of them were actual issues.

Periodic reviews seem like they could get annoying really quickly, becoming more of a maintenance burden than a help.

In his “defense,” the plan to sanction the ICC came before the Nobel. Some of the reporting even claims that the Nobel committee chose to give the prize as a response to the threatened sanctions.

He’s sanctioning the ICC because they’ve stood up to him in the past on issues like Netanyahu.

Every time I think we’ve hit maximum “cartoon villain” with Trump, I find out I was wrong.