Re: Open vs proprietary LLMs

On 26/08/26 at 07:29 +0900, Charles Plessy wrote:
> Le Tue, Aug 25, 2026 at 10:18:05AM -0400, Theodore Tso a écrit :
> > 
> > Some people have claimed that it's worthwhile to pay $20/month to use
> > Claude Code, even if you hook it up to local LLM if you have privacy
> > concerns (e.g., if you don't want to send your proprietary codebase to
> > Anthropic).  I'm not entirely sure it's a worthwhile tradeoff myself,
> > since Open Code is actually pretty good, but some people will claim
> > that.
> 
> Hi all,
> 
> I always did my best to never install non-Debian software on the machine
> that has my GPG key; no curl | sudo bash, no Zoom .deb packages, no
> non-debian sources in /etc/apt, etc…
> 
> I use OpenCode at work with models approved by my employer and in the
> worst case scenario, I do not worry about my work on marine plankton
> being spied.  However, for my Debian activities on my home laptop…
> 
> Obviously, anything agentic enough can look at the delta between the
> locally installed packages and the contents of s.d.o/debian-security,
> and run the corresponding rootkit; unattended-upgrades will never be
> fast enough to eliminate all race conditions.
> 
> So at the moment I consider that running anything agentic is taking the
> risk that it gets root privileges anytime.  Not to mention that the
> agent does not need to be root to send my private key somewhere.

Note that there are two attack scenarios here:

1/ a (malicious) model instructing the (non-malicious) agent to use
tools to read files (and leak them) or run commands

2/ the agent itself including a trojan horse (for example, because of
supply chain compromise)

Only (1) is strictly specific to AI. (2) is made more likely by AI
because of the current high rate of releases in AI-related software
(making it a good target) but also applies to any other software.

I'm growing more an more convinced that (1) Linux on the desktop is very
far from where it should be regarding per-app isolation; (2) Debian
could probably do better regarding defense against supply chain
attacks (hence my work on debaudit.debian.net).

> I would welcome guidelines on how to use coding assistants safely from a
> a specific Debian point of view.

I don't know how much it qualifies as "safely", but you can use bubblewrap[1]:

bwrap \
  --ro-bind /usr /usr \
  --symlink usr/bin /bin \
  --symlink usr/lib /lib \
  --symlink usr/lib64 /lib64 \
  --ro-bind /etc/ssl /etc/ssl \
  --ro-bind /etc/resolv.conf /etc/resolv.conf \
  --ro-bind $HOME/.gitconfig $HOME/.gitconfig \
  --bind $HOME/.config/opencode $HOME/.config/opencode \
  --bind $HOME/.cache/opencode $HOME/.cache/opencode \
  --bind $HOME/.opencode $HOME/.opencode \
  --bind $HOME/.local/share/opencode $HOME/.local/share/opencode \
  --bind $HOME/.local/state/opencode $HOME/.local/state/opencode \
  --proc /proc \
  --dev /dev \
  --tmpfs /tmp \
  --bind $(pwd) $(pwd) \
  --chdir $(pwd) \
  --unshare-all \
  --share-net \
  --die-with-parent \
  /path/to/opencode $@

[1] https://github.com/containers/bubblewrap
    https://packages.debian.org/trixie/bubblewrap

Lucas