Open-Source on digikar's microblog

Performance Comparison of Stan on Intel 228V vs Apple Air M4

Fri, 28 Aug 2026 20:09:09 +0200

Apple Silicon is definitely impressive in benchmarks. For real world tasks, however, they recommend running testing against real applications. Now, I’m not running any rigorous tests. Just some informal tests and eye-balling the times.

The most intensive task I’ve been doing this month is building and running stan models. For those not in the know, Stan is a software for bayesian data analysis. The documentation is really good. It essentially provides a rich C-like DSL (minus the memory management) to write bayesian models. It then transpiles this to C++, compiles it, and then runs it. For small datasets, both compilation and runtime become comparable.

As against my earlier announcement about the use of macbook, I eventually returned to Linux as a found a good deal on a T14 Thinkpad with Intel 228V, which has very reasonable battery life to get me through full conference days and long journeys. But I have the M4 Macbook Air lying around that I don’t want to give, because I want to use it for occasionally testing my libraries on MacOS. Cloud-hosted solutions for MacOS cost on the order of 60 USD/month, which basically means you can get a full macbook in a few months. Very unaffordable.

But more recently, I found some time and peace of mind to dive into tunneling and set up a cloudflared tunnel to access my macbook through a public domain. This means I can now access my dormant macbook from anywhere even if I don’t have a public-facing static IP.

But is it any useful? Apple M4 packs a punch. Depending on the metric, it is about 25-50% faster than Intel 228V. I also noticed that while 228V has a peak of 4.5GHz, in reality, it only spends a minute or two above 3GHz, and often settles down to 2.5GHz. I don’t know how all the benchmark numbers compare against thermal throttlings. Benchmark numbers also don’t have strong cross-domain correlations.

So, the question then becomes, for my particular use case, which is compiling and running Stan Models, how do Intel 228V and Apple M4 compare? I also found an officially maintained stan-dev/performance-tests-cmdstan repository that I hope is representative of my usage. So, [depending on how lucky you are], the following should allow you to benchmark stan on your computer. As of this writing, I’m on commit b329e269 of the repository.

1
2


git clone --recursive https://github.com/stan-dev/performance-tests-cmdstan.git
python3 runPerformanceTests.py -j N -runj N stat_comp_benchmarks # N is the number of cores

You might want to prefix that last command with time which is what I do for obtaining the below numbers. They represent duration in minutes; thus lower the better. For whatever reason, Intel 228V did not throttle while running this workload. It consistently had at least one core above 4GHz.

Test \ Platform	Intel 228V	Apple M4 (Powersave)	Apple M4 (Full)
4 cores compile + run	2:25	4:10	2:07
1 core compile + run	2:40	3:55	1:57
4 cores run	0:35	2:10	1:05
1 core run	0:55	1:55	1:00
4 cores compile (diff)	1:50	2:00	1:07
1 core compile (diff)	1:45	2:00	0:57

Well, these were obtained by eye-balling about 2 runs each, just to check if they differ. Often, the difference between subsequent runs was less than 1 second. So, nothing rigorous, but nothing totally off either. It does seem that multiple cores has negligible impact on the runs. If anything, on MacOS, the multiple cores actually degraded the run! It’s also possible that difference in compilation times are due to the difference between g++ on Linux and clang++ on MacOS; I could not trivially get the system to compile with clang++. There could also be a bunch of different optimization flags that are not being used.

That said, it seems this is not the workload where I will get any significant benefits from Apple Silicon in the immediate future. There are similar reports and discussions here, here and here. Most of the reported gains seem to be from testing a 2018-era CPU to the M-series Apple Silicon :/. That’s not to dismiss the energy efficiency of Apple Silicon. M4 gets me about 2 conference days(!) on a single charge. Its standby time is also something that might put smartphones to shame. But at least for this particular workload, it doesn’t seem it’s a great fit.

Nostr: The next step to decentralized social media

Sat, 18 Jul 2026 18:25:34 +0200

In 2005, Huffman and Ohanian got together and launched what they called the “front page of the internet”. Here, users could post the best articles from news outlets, journals, or even images and just text posts with each other, upvote what they liked and help others find good content. This platform was called Reddit. In 2026, reddit is still the 8th most popular website on the entire internet even more popular than WhatsApp(!)

Around the same time, in 2006, Dorsey and others launched another platform that allowed people to share SMS-sized chunks of text with each other. This was Twitter, also known as X in recent times. In 2026, X is even more popular than Reddit!

Likewise, the other top websites include Google, YouTube, Facebook, Instagram, ChatGPT(!), WhatsApp, and TikTok. Each is owned by some or other private corporation.

The open source enthusiasts amongst us are not very happy with this state of the internet.

First, the public internet is supposed to be public. Anyone who has access to the internet, should be able to view the content they want to view without barriers. Platforms like X, Facebook, Instagram, WhatsApp, TikTok, and to a lesser extent also Reddit and YouTube forbid non-users from viewing the content. In other words, every time you visit one of these platforms, you need to have an account with them to view content. Ever been annoyed by the constant popups for log ins or location-based restrictions? Well, it doesn’t have to be this way!

Secondly, if some content does not comply with the policies of platform moderators, it gets removed. For X, this takes the form of centralized moderation by X sometimes following government orders and sometimes mistakes. On reddit, the story is slightly more complex. While Reddit as a whole has some policies, the actual moderation is performed by volunteer users – known as moderators – so long as the content still agrees with the top-level policies. Until 2023, reddit moderators had access to third party tools that made moderation relatively doable. These tools also provided various other accessibility services. However, in 2023, Reddit introduced changes that made third party tools either non-free or impossible. After Reddit did not budge to appeals, many users and moderators quit reddit. Though, before deleting, they also deleted their comments, accounts, and also made their subreddits inaccessible. If you came across “deleted” or “unintelligible” comments on reddit, this was the context under which this happened. I myself cannot stand the “official” [android] reddit app to this day, and limit myself to its webapp.

Were moderators just shitty humans for protesting and had no brains? Well, I’d perhaps be displeased at the content deletion, which has AI and content disattribution to blame too. But more importantly, reddit moderators are volunteers. They moderate out of their own time and passion, and without any monetary compensation. And subreddit moderation can be tough and also require actual qualification! And yet, what reddit offered them in return was a ban of the moderation tools themselves!

What has open source to do with all this? Open source means you have access to the software and the source code that runs the software. If you don’t want a certain change to happen, or if you want a certain change to happen, you are completely free to make that change. Though, indeed you still need your own computers, servers and devices to run the modified software! In other words, if reddit were open source, this mishap could have been avoided!

Well, not quite, there was still the possibility that moderators and admins of open source reddit of this counterfactual universe might still have went ahead with the API changes. What is needed then is the ability for multiple “reddit instances” to talk to each other, so that if you disagreed with the moderation policies and tools of one instance you could switch to another. Turns out this actually exists! People have been working on this – Fediverse – since the 2010s. The idea is exactly that multiple “instances” or “versions” of reddits – and even instagrams, youtubes, Xs, mediums and goodreads – can freely talk to each other. Users can sign up on one instance and use that same account on other instances. They can “subscribe” to as well as post content on other instances.

That sounds very good. Sounds.

In practice, there are 494 lemmy instances alone. I won’t even start to count Mastodon and others. Several problems arise:

It’s supposed to not matter which lemmy instance you sign up for. However, it actually matters, because if the instance you sign up for goes down – say, because the admins ran out of funds or there were some server issues, etc – your account goes down with that instance!
Each lemmy instance has its own set of communities. So, c/programming on lemmy.world is a “different” community than c/programming on lemmy.ml. In principle, you can subscribe to both of them. In principle, different lemmy instances and communities can subscribe to each other. But are all the 494 lemmy instances going to do that for all the 493 other lemmy instances? That simply does not scale!

And there are all different kinds of bugs arising from database duplication and what not.

But, there is an alternative!

Enter the Nostr protocol - which literally stands for Notes and Other Stuff Transmitted by Relays – that was developed as recently as 2020.

The elements of Nostr map quite straightforwardly onto the real world. In the real world, our identities are owned by us. When we talk, a medium – air or something else – transmits our message to another user. In Nostr, similarly, the identities are owned by us. These identities can write messages that are transmitted to others via what are called relays. This is in contrast to Lemmy and Fediverse, where identities belong to the server-instance. Thus, it can appear quite strange when one views Nostr through the lens of existing social media. On the other hand, when one views Nostr through the lens of the real world, it seems very straightforward. This separation of Nostr identities from relays also means that when a relay goes down, even when all relays go down, that identity still remains with you!

Using concepts from cryptography, a Nostr identity takes the form of a public key called npub and a private key called nsec. Both of these are essentially long sequences of random characters. These keys are used by Nostr clients. As its name suggests, an nsec is something you should never share with other people or Nostr clients you don’t trust!

Whenever you write a note using a Nostr client such as Amethyst, this nsec is used to sign your note. Other users can then use their own Nostr clients to verify using your public key npub that, indeed, the note was actually written by you, and not someone else falsely claiming to be you.

Note that, in verifying that a note was actually written by you, no server or central system is necessary! Some kind of relay is still necessary for transmission. But it is a relatively dumb software that simply transmits notes from some clients to other clients. This is as good as air. Air does nothing. It just transmits my voice to you!

A relay can still filter out notes. However, it is ultimately the client who decides which other users’ notes to actually show you. Most clients do this in two ways. Firstly, you can “follow” other users npubs. By doing this, you should get the notes they write or reshare in your feed. Secondly, you can browse content from some relays and also filter them out on the basis of various criterion. For example, if you dig a bit into Nostr, you might notice that it is surrounded by bitcoin and cryptocurrency ~~enthusiasts~~ freaks. I usually have a preference for content other than bitcoin. So, I have set “bitcoin” as a filter term in my client. This means I don’t see anything mentioning bitcoin in the first place!

You can probably start out with nostr.org or nostr.how and then explore the internet to learn more. The “Join Nostr” on nostr.org should already get you a pair of npub and nsec that you can use for posting.

More importantly, for merely reading, you don’t need any keys or install any software at all! You can just use a Nostr webclient – Primal is usually a recommended choice. Amethyst is a reasonable android app.

If you decide to give Nostr a try, do follow me! digikar

HackerNews 250 is another interesting poster to follow!

All that said, I wouldn’t say Nostr is as smooth as Instagram 👀. So, expect some friction. More importantly, there is the Network effect which means Nostr won’t provide much value until there are enough users in one’s own circle using it. It is probably a decade too early to advocate Nostr.

I myself am passively looking for bot tools to automate content posting to Nostr from other platforms. But I currently have my hands on a bit too many things, so I’ll relegate that, perhaps, to 2027 or later.

The role of Open Source and Data Privacy for Security

Tue, 13 Jan 2026 18:08:32 +0100

Internet has been amazing. You send a message. And it reaches the other end of the Earth in seconds. Even more, you can communicate with live video and audio! It seems magical.

Yet it is not. All communication is transmission of energy. Energy travels through space – which may be occupied by matter or may not. Most space through which communications travel is openly available to everyone. The same space is used by multiple communicators. Does that mean everyone can access the messages I send over the internet?

That’s a scary thought. All your bank account details, passwords, private messages, your voice, your tone, your looks*, all travel over the internet. Are these all available to the public at large? (*You know now with generative AI, your voice and looks are sufficient to prepare videos as if you had done or said things you hadn’t!)

Unfortunately, in an unencrypted world, it would be true that everyone can see everyone’s messages. You can read malicious users’ messages, and they can read yours. Furthermore, what even determines that a message your messaging app says was sent by your friend was really sent by your friend? And not someone else disguised as your friend?

Humans, some of them, are smart. These problems have been known since the dawn of the internet in the 20th century, possibly before. Solutions have been devised against them. Today, for most communication problems in the general, we know that

If communications satisfy certain assumptions, then certain particular security benefits are guaranteed.

In other words,

If we build communication softwares that satisfy certain assumptions, then we get certain particular security benefits.

These benefits include:

Knowing that the message your messaging app says was sent by a friend was really sent by your friend’s device.
Ensuring that only you and your friend can read messages sent to each other. That is, your messages are inaccessible to anyone else.
… and many more …

In general, the “friend” may be any other communication end-point, such as your bank, where security is just as important if not more. However,

How do we know that communication softwares actually satisfy the assumptions required for security?

Three methods:

We trust the word of the person or institute who developed the software and make profits from the software. In general, the greater motive here is making monetary profits, since that is a very essential aspect of livelihood of the person or institute.
We trust the word of the person or institute who is motivated to study and develop the software and ensure the software satisfies the assumptions required for security. In general, monetary profit as a motive is either absent or very much secondary.
We study the workings of the software ourselves.

Both 2nd and 3rd methods require that how the software works is publicly accessible. This means the source code (but also the infrastructure details) are publicly available. In other words,

Trusting the claim that a particular software is secure becomes easier when the workings of the software are publicly known, that is, it is open source.

How to find open source softwares?

An easy method to find the open source alternative for a software is to simply google "open source alternative to software that interests you". You can also append the search by "site:reddit.com" or "site:stackexchange.com" or you can also consult one of your tech-geek friends or family-members.

It is trivial to see that between two people or institutes:

One who is motivated by monetary profits
Another who is motivated by software security

The second category of people or institutes would end up with more secure softwares in any particular class of softwares in the longer run. In other words, in the longer run, the first category of people or institutes are likely to make mistakes even if, besides making money, they too want to make their softwares secure. This is simply because, for the software developers, motivation for software security drives learning and brings in the time to spend on the software and make changes that may go against the monetary motivation.

That people and software developers can make mistakes brings us to the second point of this blog post. Your data includes - your name, phone numbers, email addresses, passwords, bank account numbers, people or institutes you send messages to or receive messages from, what messages you send, which websites you access, how frequently, at what time, for how long, your phone location, when do you leave your home, office or visit a friend, and much more.

You would WISH that the banks, institutes, and messaging softwares that have access to your data are actually storing them securely, in a manner that does not permit thieves and malicious actors from misusing your data.

This is also called a data breach. In 2025 alone, there were at least 5 data breaches with banking softwares resulting in millions of individuals losing their banking details to malicious hackers. It is not just banking softwares. Data breaches can happen with car companies, education providers, beer companies, sim providers, luxury brands, and pretty much everything that is connected to internet.

If the softwares were open source, it would be easier to ensure security. However, the next best thing to open source might be data privacy. How do you prevent your data from being misused?

To prevent your data from being misused, you restrict your data from being accessible. That is, you keep your data private.

How do you make your data more private? This is a bit like asking How do I make myself more healthy? There’s no simple answer, although one can try some guidelines! See here or here for a detailed guide. Here’s an attempt at some guidelines:

Reduce reliance on closed source softwares for information processing. This includes Microsoft Word, Powerpoint, Excel, as well as Google Docs, Slides, and Sheets, and also Apple. Of course, you may be forced to use these apps because your colleague uses them. In that case, either convince them to shift to open source alternatives or use the open source alternatives for your personal use cases. Simple alternatives include markdown, latex, and open document formats.
Try out Kubuntu on newer laptops or Xubuntu to renew old laptops. Be sure to use the “Long-Term Support (LTS)” versions, currently 24.04. You can also try it as a virtual machine.
Switch to secure open-source messaging softwares:
- Signal or Molly in addition to Whatsapp, Messenger, Instagram.
- Jitsi in addition to Zoom or Google Meet or Teams
Use password managers like Bitwarden.
… You are motivated enough. Read one of those detailed guides now :)

To sum up

Open source aids security. You can find open source alternatives by simply googling “open source alternatives to <app you want>”. Optionally, you can append the search with “site:reddit.com” or “site:stackexchange.com”.
Privacy aids security. Privacy is a bit like moving towards a healthy lifestyle. There are lots of small changes in the way. See this or this for a detailed guide.