‹ BackHN Continuity

Thread

Run Qwen 3.8 Flash Next (125B) on consumer hardware (RTX 4090) at 100T/s

741 points · 330 comments · snehesht

  1. deadbunny · · focus · HN ↗
    &gt; Set up Strata on this PC for me: <a href="https:&#x2F;&#x2F;github.com&#x2F;Niko1221&#x2F;Strata" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Niko1221&#x2F;Strata - follow docs&#x2F;AI_SETUP.md in that repository.

    And I thought piping to bash was bad

    1. Skunkleton · · focus · HN ↗
      I&#x27;ve never understood the security argument people are making when they complain about `curl foo | bash`. I get that these scripts sometimes mess up your bashrc or whatever, but from a security perspective I see no issue. You are already installing software from the same domain. If they were going to do something nasty, they could do it with any of the software you are using from them. It doesn&#x27;t have to be the setup script.
      1. minitech · · focus · HN ↗
        To compare it to just one other option: when you run `npx foo`, you know* that you’re getting the same public artifact that anyone else running it at the same time would get. (If you have a `min-release-age` configured, you also benefit from that.) If I wanted to distribute software like this, I’d include npm-shrinkwrap.json; then, with `npx foo@1.2.3`, you could be similarly confident in getting the same app every time.

        (I picked this option for ease of comparison, getting a couple of major security wins with very low effort; I don’t recommend `npx`ing stuff in an otherwise unprotected environment either.)

        * well, you can be somewhat more sure

        1. athrowaway3z · · focus · HN ↗
          So to be clear; the solution is then something like

          `curl <a href="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;my&#x2F;domain&#x2F;setup.sh" rel="nofollow">https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;my&#x2F;domain&#x2F;setup.sh | sh`

          Note we dont even have a hash there - just a promise that a third party (github) has a log of whatever was hosted at that url.

          1. nagaiaida · · focus · HN ↗
            maybe then we&#x27;ll pin hashes instead of filenames, and oops now anybody can fork my&#x2F;domain and hand out a link that looks official with whatever contents they wish
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.