pull down to refresh
The article didn't stop at egress traffic. Which by the way I don't see how you can deny if you use tools such as a search engine. I quote:
Locking the model in a box with no internet solves only half the problem, because the code it writes still ships, and that code can contain vulnerabilities that can later be exploited. Independent research has found that some models write weaker code depending on who it's for
Let's be honest though, American models probably do the same, just that it is for Freedom or oil res... oops Democracy.
Off-topic but this article made me want to try their model.
the code it writes still ships
Once more, it already implies what must be done. must be done. The only reason it isn't done by nearly anyone is because not only do we no longer want to code, we also don't want to have an opinion about code we ship, and code we run. We simply don't want to put in that effort anymore. We are therefore our own worst enemy because we have FOMO'd ourselves into great vulnerability. Not hypothetically, but literally; it is everywhere around me. Defense is incredibly expensive now because the supply chains are filled with neglect.
The only place I've discovered where people are pretty vocal about and are creating a culture of actively resisting this mindset is in the commie blue haired, gender-fluid mastodon-based sploit communities made up of they/thems that appear to have nothing but buttsex and hatred of the botlords on their minds. I don't really want to spend time there, and I feel that they're right for the wrong reasons, but if I were hiring, I'd strongly consider that resource pool despite all the downsides and endless drama, because only having yolobois on your team has always been a losing proposition.
Defense is incredibly expensive now because the supply chains are filled with neglect.
Not a prediction but as a trend I would expect security to get better over time. Although for sure now it is quite messy. At least what was hidden in the past is now visible, and not doing anything for security at least now costs money.
The only place I've discovered where people are pretty vocal about and are creating a culture of actively resisting this mindset is in the commie blue haired, gender-fluid mastodon-based sploit communities
Interesting, I didn't know. At the end of the day you may disagree on side topics like politics but diversity of people is a strength isn't it.
Also the article from Cohere links to other interesting articles. One for example which mentioned this model:
https://huggingface.co/hirundo-io/Qwen3-Coder-30B-A3B-Instruct-Westernized
Hirundo claims it improves coding quality regardless of the target (source: https://www.hirundo.io/blog/qwen3-coder-vulnerabilities)
Just in case though, my usage of llm models is pretty much apolitical so I never had the issues mentioned. I am sharing it just because you mentioned blocking egress traffic would solve all issues mentioned. I am not sharing this because I tested it or want to recommend models from Hirundo. And I am not saying also we should not use Qwen.
sudo ufw default deny outgoingikr.