Re: Open vs proprietary LLMs

Le Tue, Aug 25, 2026 at 10:18:05AM -0400, Theodore Tso a écrit :
>
>Some people have claimed that it's worthwhile to pay $20/month to use
>Claude Code, even if you hook it up to local LLM if you have privacy
>concerns (e.g., if you don't want to send your proprietary codebase to
>Anthropic).  I'm not entirely sure it's a worthwhile tradeoff myself,
>since Open Code is actually pretty good, but some people will claim
>that.

Hi all,

I always did my best to never install non-Debian software on the machine
that has my GPG key; no curl | sudo bash, no Zoom .deb packages, no
non-debian sources in /etc/apt, etc…

I use OpenCode at work with models approved by my employer and in the
worst case scenario, I do not worry about my work on marine plankton
being spied.  However, for my Debian activities on my home laptop…

Obviously, anything agentic enough can look at the delta between the
locally installed packages and the contents of s.d.o/debian-security,
and run the corresponding rootkit; unattended-upgrades will never be
fast enough to eliminate all race conditions.

So at the moment I consider that running anything agentic is taking the
risk that it gets root privileges anytime.  Not to mention that the
agent does not need to be root to send my private key somewhere.

I would welcome guidelines on how to use coding assistants safely from a
a specific Debian point of view.

Have a nice day,

Charles