Mosty probably: not. Traffic passes throught the ASIC, usually it is not processed on CPU or custom code. Unlike typical web servers, that reduces the attack surface as there aren't software parsers (a common place where vulnerabilities hide). Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.

> Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.

I'd love for that to be true. Unfortunately, a lot of consumer routers are fairly straightforward Linux systems with no particular attempts at hardening.

but he has a point that if the ASIC is doing the TCP header offload, wouldn't this particular CVE not be applicable?

I'm not sure. Maybe it would; maybe the IP options would make the packet bypass offload and get processed by the kernel. Either way, I wouldn't want to rely on hardware NAT offloading as a security feature.

The bug in question is not mitigated by any userspace actions (like signing binaries or boot images) or even by limiting syscalls, and all it takes is a listening socket on the device from either direction (inside or outside the network) to get root since router-destined packets are always processed by the CPU.

All traffic? In particular, I'd expect new connection establishment to go through a software path, looking up port forwarding and firewall rules etc. and creating hardware forwarding table entries if applicable.

I really do not get the obsession with translation, particularly bad translations and translating by default. Most people who browse websites in languages other than the official local one are fluent in that other language.

Google Chrome keeps insisting that Spanish is Galician. PowerPoint insists on changing the spell checker back to the wrong language and ignores setting the language for the whole presentation. On Linux, ChatGPT insists it must enable the spell checker in the local system language, so everything is always red.

Privacy aside, a lot of software seems to be built assuming people cannot be multilingual.

Both are true, a lot of people are multilingual but a lot are also not.

I know a lot of foreigner for which the feature is really useful (local department store, booking a doctor appointment etc.)

I don't know many people, but I do know someone that relies on machine translation to browse the English web. Remember "most" is not "all." The web should be accessible to every single person.

I dislike this approach. In my opinion it is much useful a 1x/2x billing based on hour like Deepseek does. Being unable to use it at the hours I need it makes me want to remove the service, not upgrading it.

Now, if I could afford 4...

That is how you get a hardware provider to stop selling you stuff

Personally I have been using Deepseek V4 flash and it is enough for my needs. You can use OpenCode Zen/Go and also get access to many other models, including OpenAI ones. Writing purpose specific agents can make cheaper models close the intelligence gap with the most expensive ones

I'm suspecting it is Deepseek flash-vision-exp V4

Unless it's an avant-garde A/B test with two endpoints targeting the same model, we now know it isn't.

no, and in fact they should be extremely easy to detect if they are substituting a token that is a least-probable synonym

I practically switched to doing everything with Luna or DeepSeek V4 flash. I haven't feel the need for the more expensive models.

I am in the same boat as you. I am using Luna and DeepSeek Flash. Both super fast, super cheap, and I have not felt need for anything more capable in few weeks.

I'd like to try DS4 if Cursor adds it

I'll use it locally too, but we use Cursor for work

Of the two, which do you find better?

I really, really like DSv4 Flash because you see the full, real thinking text. That’s been so useful for helping steer the model; as well as seeing its thoughts and correcting any errors, or expanding on it. It’s so difficult for me to use closed models with no or summarised thinking now — it feels so painful and gimped.

You don’t know what you’re missing until you’ve seen it. For me it’s almost like going from standard def to HD for the first time.

(This applies to other open models too — Kimi K3 in real world feels below Opus 5 in terms of raw intelligence, but significantly above Opus 5 in usability and personality. And no silly refusals — the model feels like it’s working for me; not working for Anthropic who’s always holding a leash over the model while I pay for it).

I prefer V4 flash, but Luna is ok and included in the OpenAI plan I'm already paying, so... that is the reason I use it.

I gave DeepSeek $50 around june, and I haven't been able to exhaust them yet. The model is super cheap and more than enough for my needs.

I'm my opinion, Flash V4 is less pedantic than OpenAI models, less prone to unsolicited prescriptions and less prone to "helpfully" reinterpreting my instructions (wrongly, of course).

Language distribution shifts. Eventually people will start adopting the distribution used by LLMs, making classification harder.

Also, this doesn't even consider the case where people use LLMs to translate their original works. Or people that use it for spelling/grammar checks.

Personally, I believe these checkers do more harm than good. Any false positive can ruin someones life.

> Eventually people will start adopting the distribution used by LLMs, making classification harder.

I recently heard someone say "that's genuinely the exact solution I was looking for" and had to do a double take.