So far I've settled on one jumbo VM with many Incus containers inside. Nothing goes inside the VM that I can't afford for agents to exfiltrate. I've been really happy with this setup.
This is actually interesting. I'm no cryptographer. Do modern algorithms take into account that certain values should be avoided because they would be obvious things to try first in a brute force attack?
The algorithms don't care because it doesn't make sense to care, the same reason a "smallest non-interesting number" wouldn't make sense - now that number is interesting precisely because it was cited as the smallest non-interesting number.
However practical applications do care, and so e.g. the "Debian Weak Keys" are a relatively small set of keys which would have been generated if you used a particular patched OpenSSL to generate "random" key pairs after a mistake patched out most of the randomness. Many of them were used by Debian sysadmins particularly in the window between the patch and the discovery - and so all CAs are expected to check that you're not trying to get a certificate for the public half of one of those pairs.
There's nothing "bad" about those keys except that well, we know some people used them so bad guys will try the private halves of those keys just in case. Likewise there are a few apps which shipped with a baked in "default" private key, and all the paperwork to apply for a certificate but obviously a user may not realise that if they just fill it out with their name and details, they're now vulnerable to attack by literally any other user of that software. They were supposed to generate a random key pair and re-generate the paperwork for the resulting random values. If they don't realise we need the CA to say "Nope, that's a bad idea, not issuing" even though these keys aren't special in any other way than they're given to every single user of that software.
IIRC when I worked for a famous US corporation their middleboxes relied on such a well-known key and at some point I asked "Hey, this seems wrong. Why did you do this?" and as often has happened in my career I got no actual reply to my question but magically the issue was fixed in short order. The first clumsy attempt to fix it broke some things, but they gradually figured it out. Glad I could help, I guess.
If your generation is any good the odds of ending up on such a number should be astronomically small.
Biasing something that should be random tends to badly backfire. See the Enigma who avoided enciphering letters to themselves, which was then used to break it.
Love Handy. It has become a core piece of how I use computers.
In case it's helpful to anyone else using it, at first it felt a bit slow to me, because there was a noticeable pause after I finished a message before it would quickly type it all out. I changed the input method from direct to clipboard and it's way faster now, almost instantaneous.
> With my OpenCode Go sub of $10/month, DeepSeek is basically unlimited
My OpenCode Go monthly window was scheduled to reset this morning. It was sitting at 22% used despite me using DeepSeek V4.1 Flash heavily as my implementation agent the past couple weeks (I use gpt-6.1-sol high for planning/orchestration).
I had 1.5 hours left so I fired up first 10, then 20, and finally 50 concurrent subagents all working on reverse engineering C code from an old PC game. They found over 100 new functions.
This is the first workload I've found that could make a dent in my sub. It got my 5 hour window to 85% used, but sadly my monthly was still only at about 35% when it reset. So that cost maybe $2.
How are you guys doing orchestration? I have been fumbling around in my free time trying to build something for myself but is there a repo or something that just works?
I might not be the best person to ask. I use Pi harness in tmux and just ask my current agent to spawn interactive pi instances in new tmux windows, create a sentinel file for each of them, and monitor the sentinel files for signals every 2 seconds.
Currently have auto compaction turned off. When the orchestrator's context is getting close to full, I have it write a handoff markdown file and point a fresh agent at it.
I do feel like I'm getting close to the point where I might be ready for something more sophisticated, especially wrt to subagents communicating with the orchestrator.
That limitation is what stops me from using Pi for anything serious. I may have to configure it and then configure it and it will eventually become a codex, a claude code or so. I recently heard the maintainers added mcp to it (in stock, not via plugin), I wonder what stopped them from adding subagent function, and decent loop capacity to it.
> Currently have auto compaction turned off. When the orchestrator's context is getting close to full, I have it write a handoff markdown file and point a fresh agent at it.
In a good harness that should be how auto compaction works anyway
Yes, and I'll probably trust it eventually. But currently I always want to know when compaction is happening, so I can correlate any drops in quality or weird behavior.
The tightening of subscription value has already begun. dsv4.1f is already worth paying for at market API prices. Maybe it goes to 2x because apparently no one has figured out how to match DeepSeek's insane caching efficiency, but I don't see it getting much worse than that.
Plus you can also get dsv4.1f subsidized. OpenCode Go gives 4x if I understand their pricing correctly. Anecdotally, I feel like I get way more out of my $10/mo OpenCode Go sub for the price than my $20/mo ChatGPT, even using gpt-6.1-sol high which is very cheap, and I have yet to convince myself dsv4.1f is a worse model.
It's really not cheaper than frontier subscriptions. It's getting closer, and it's a great model, but it is not more value per task than the frontier subscriptions. Don't be swayed by the token costs, it's very chatty, like 3x more tokens for the same task as sol. I used dsf 4.1 full time for about a week.
It blows frontier API pricing out of the water, but again, look at cost per task, not token usage. Still easily wins though for my work.
I do think it's the most viable alternative I've seen so far, and that applies pressure to the frontier models. Should subscription prices hike or become unavailable for some reason, I know what I'll be using.
When pricing this, it's important to consider whether or not you want to opt out of data training. You won't get the advertised rate. Also the dsf 4.1 subscription providers are throttled af... and of course they are, because otherwise they'd be haemorrhaging money.
> It's really not cheaper than frontier subscriptions.
It depends on how you use it. I used to have the $100/mo Claude plan. I would easily blow through limits when I was on the $20/mo plan, but would rarely hit them when on the $100/mo plan.
Lately I've been using GLM 5.3 Flash (from Fireworks), and my spend is $1-$2 per day when I use it for coding, so max $60/mo (less, since I don't use it every day). IIRC DeepSeek 4.1 Flash is priced similarly.
If I had to pay API rates for frontier models, I can't see how $2/day would cut it. Maybe GLM/DS are chattier, but not anywhere near the 10x required to make the price difference not matter.
Sure, if you're running agentic loops all day, 5 days a week, you're probably going to blow past even $200/mo in API charges pretty quickly.
I suspect you are right. For context, I was assuming a 20x w/ OpenAI or Anthropic subscription as the comparison (or both). dsf 4.1 was going to run me about 2-3 times the cost of either of those for the same amount of work. Obviously you can optimize differently, but that's true of subscriptions too. I was using pi and had it evaluate it's ideal context compaction point based on usage and API rates. Keep in mind though I was using a ZDR provider, so slightly higher costs. If I want them to train on my code, I could shave a few $ off.
That's not even taking into consideration all of the resets you get from the frontier subs. Which lately seems to at least double usage (more like 5x recently with OpenAI if you count the credit grants). But OpenAI is tweaking it's pricing, so it's always a moving target... which is kind of annoying until you learn to just ignore it.
DS4.1 flash is $0.30 in / $1.20 out (per M, peak, cache miss)
Opus 5.5 is $4.00 in / $20 out (per M, cache miss)
However, that is API prices.
Anthropic offers a $200/mo subscription. How this translates into usage is admittedly a bit opaque, subject to change, and depends on how exactly you use it. But it's a lot of usage - Semianalysis data shows that $200 is getting you around $2,500 of usage at API rates if you use Opus 5.5. This is close to what I'm seeing anecdotally with my accounts, if anything I have been getting a bit more.
Now, unlike DeepSeek, you can't use your subscriptions to power live AI-driven products, or resell tokens in any way. But for personal coding agents, you can use as many of these subscriptions as you want, for now. So I am paying effectively basically 8% of the published API rates, so at my usage:
DSv4.1: $0.30 in/ $1.20 out
Opus 5.5: $0.32 in / $1.60 out
Obviously, those aren't real prices, but they accurately convey apples to apples what my everyday usage costs me and most other heavy users, and why it's so easy for me to stick with Anthropic/OpenAI.
I don't think it's a coincidence, either - I think the token allowances for these subscriptions are set to be competitive with the open models, so that most coding users (and their incredibly valuable data) stay with the frontier labs, while VC-funded wrapper companies and less-price-sensitive giant companies with strict procurement policies pay exorbitant markups for enterprise contracts at the API rate.
Locked into their tools though. I happen to be very tied to a IDE centric model (old dog can't learn new tricks) and their Desktop thing is a regression for me. I can use the cli, but it wrecks the muscle memory I have with what I use now.
And Anthropic is somewhat unusual in that 10x more tokens via the subsidized path. I imagine more rugpulls are coming.
Not disputing your point in any way, just noting there's already caveats, and more are likely coming.
> Not by cost per task, just cost per token. But they're spending way more tokens per task, so it doesn't work in their facor.
They are not most expensive per Task. DeepSeek 4.1 flash is bloody efficient.
I currently did run a test myself:
- Use the pay as you go offer on OpenRouter on the same task on two different project: Perf optimisation on C++ codebase both with Anthropic and DeepSeek.
- I exploded my 15$ budget in a half-week with Anthropic.
The argument that most people are making isn't that dsv4.1f is better than frontier, but that it's good enough for most tasks, faster, and way cheaper.
> if one looks at the CoT, it's evident that it's way way stupider than frontier models
reply