Suraj Verma 🇮🇳

I build, test and explain tech for everyday use. AI, Linux, open source, privacy & user choice. India 🇮🇳 | शिव भक्त 🕉️

[Suraj Verma 🇮🇳 @vermaizer]

@callebtc The nearby APK sharing is a clever way around the distribution block. The remaining friction is Android's installer boundary: the receiving user still has to explicitly allow installs from that source. It keeps Bitchat distributable, just less accessible to normal users.

[Suraj Verma 🇮🇳 @vermaizer]

@hwchase17 Step 1 is the one I'd think about before copying. Tracing everything from a coding agent means prompts, file contents and diffs from your repo end up in a trace store. Self-hosting fixes that, but it's worth deciding before you turn tracing on.

[Suraj Verma 🇮🇳 @vermaizer]

@Nitesh805181 Funny part is Samsung Pay has done this in India for years, with cards from multiple banks. Apple Pay launched with only Axis Bank credit cards. iPhone users are the ones catching up here.

[Suraj Verma 🇮🇳 @vermaizer]

@jarredsumner Is the 430 -> 304 MB drop mostly from not shipping source text and bytecode alongside the AoT code? The JSC PR mentions both. Curious how much of the Sep 29 "nearly 2x" is left.

[Reclaim The Net @ReclaimTheNetHQ]

Google's Android developer ID requirement is now live. Apps from unregistered developers are blocked on certified Android devices in Brazil, Indonesia, Singapore, and Thailand. The rule goes global in 2027.

To register, developers hand Google a government ID, their legal name, address, email, and phone number. They also pay $25. This applies even if the app never touches Google Play.

Google says sideloading isn't going anywhere. F-Droid called that claim "clear, concise, and false." Users who want an unverified app now face ten steps, developer mode, several warning screens, and a 24 hour wait.

Google is clearly putting the squeeze on Android's openness.

https://t.co/dhJ63S2uOK

[Suraj Verma 🇮🇳 @vermaizer]

@TutaPrivacy I'm with Tuta on this. Google says power users still have ADB or an advanced flow, but most people using F-Droid aren't developers. It's my phone. Warn me as loudly as you want, but what I install and from where should be my call, not Google's.

[Tuta @TutaPrivacy]

🚨 GOOGLE IS KILLING ANDROID FREEDOM. 🚨

This #DiDay we call on you to take action & sign the petition: 
https://t.co/pMT2XhrZGC
Because Google must not decide what you can & can't download on YOUR Android device.

This undermines one of Android’s defining features: the freedom to install software from wherever you choose. 😤

#Android is supposed to be open, & your phone should be yours → NOT GOOGLES.

It’s time to support open alternatives like @GrapheneOS ✊

Find out more: https://t.co/c89lutjb4k

[Suraj Verma 🇮🇳 @vermaizer]

@ni5arga Sideloading doesn't make the App Store removal irrelevant on iPhone in India. Apple's alternative app distribution is limited to the EU, Japan and Brazil. Android is a different story, but on iOS this still blocks normal users from installing it.

[Suraj Verma 🇮🇳 @vermaizer]

@thdxr Types are useful feedback for agents, but the agent can also silence that loop with an assertion. TypeScript explicitly says assertions are erased and do no runtime checking. So typecheck is one feedback loop, not a substitute for runtime tests.

[Suraj Verma 🇮🇳 @vermaizer]

@DocumentingAGI Worth separating open-weight from open-source here. Kolibri's Apache 2.0 terms cover the published weights and config, while the underlying code, architecture and training methods are explicitly excluded. The FP8 weights alone are also about 78 GB.

[Suraj Verma 🇮🇳 @vermaizer]

Claude Code just fixed an interesting permission bug.
You could deny Claude permission to read a file, but that rule wasn't always applied if the file reached it through an IDE @-mention/selection involving a symlink.
2.1.289 fixes that, along with other Bash permission edge cases.
A useful reminder for coding agents: a "deny" rule is only as strong as every path that can reach the same resource.

[Suraj Verma 🇮🇳 @vermaizer]

@akshay_pachaar @datalabto Lift looks genuinely useful, but "matches Gemini" hides a big gap: 90.2% vs 91.3% field accuracy, yet 20.9% vs 40.0% full-document accuracy. The ~3x speed figure also comes from Datalab's own benchmark.

[Suraj Verma 🇮🇳 @vermaizer]

@Yuchenj_UW Codex's agent-first UI still surfaces terminal output, diffs, test results and approvals, and the desktop app now supports Remote SSH. The abstraction changed, but the underlying review and execution primitives are still there.

[Suraj Verma 🇮🇳 @vermaizer]

@techamericaofcl Store removal and actual installability aren't the same on Android. Bitchat's official site still links a direct APK, and the Android repo can be built from source. So losing Play distribution makes access harder, but doesn't fully remove the app.

[Suraj Verma 🇮🇳 @vermaizer]

@Psalteric To people who are looking for source, here it is: https://t.co/ZEaPSSBmt3

[Suraj Verma 🇮🇳 @vermaizer]

This is the kind of project that makes me curious enough to try it. I already find running Pi-hole on something like a Pi Zero 2 W pretty neat, but squeezing DNS ad blocking into an ESP32-C3 with 400 KB of RAM and 4 MB of flash is ridiculously cool.
The 500k domain claim makes me even more curious about how it holds up in real-world use, especially with custom rules, blocklist updates, multiple clients and long-term reliability. Would love to try this.😃😃

[Suraj Verma 🇮🇳 @vermaizer]

Outbound approval makes sense. I'd put the harder boundary on inbound mail though.
Email bodies are untrusted input and can contain prompt injections, so I wouldn't put them directly into the same agent context that has tools or secrets.
Extract structured fields first, then pass only what the agent actually needs.

[Suraj Verma 🇮🇳 @vermaizer]

@asgerami One useful distinction: on Team/Enterprise and managed machines, Anthropic loads sec-default first to stop user mods from overriding managed deny rules.
So the trust boundary is quite different on a personal install vs a properly managed team machine.

[Suraj Verma 🇮🇳 @vermaizer]

Meta just made it possible to build your own Muse AI hardware with an ESP32 or Raspberry Pi.
The SDKs and firmware are open source, and Meta even shows a Pi controlling Home Assistant as an example.
That's genuinely useful for tinkerers.
One distinction though: the device layer is open source. Muse itself isn't running locally. Setup still requires a Muse SDK token.
So you can own the hardware and hack the integration, while the intelligence behind it still depends on Meta.

https://t.co/JkFHIvTWBW

[Suraj Verma 🇮🇳 @vermaizer]

@MrBkofficial Small clarification on the 24-hour part: the wait is for enabling Google's Advanced Flow, not for every unverified APK you install.

Once you enable it indefinitely, future installs still show a warning, but you don't have to wait 24 hours each time.