A frog in a pond, just in front of my house. September 2026
I'm writing this almost at the end of October, and as it seems now usual for these notes, the past 3 months have been full!
Canada
I've travelled to Canada this summer to meet with my colleagues, and also to meet the culture there, and explore nature. I've been wanting to go there for years now, and the opportunity kicked in.
The timing was really weird, especially for me who refused to take the plane for almost a decade: the forest was burning in France at the same moment I was in the plane. While one knows it's not directly connected, I felt very disconnected.
It has always been important for me to meet the folks I work with "in the flesh": I think some interactions only happen around a beer, in a park, when walking under the rain. And this time was no exception.
It's always a bit hard for me to be in this position because, as much as I would like to have a good English, it's still not my native language, and I sometimes hit my own limitations.
Dangerzone
We've used this time to discuss and align on how we want to handle things in the future.
dangerzone-rust will be our focus for the future! Great news. It will simplify packaging work and will make us take another look at our release procedure.
I've worked on a documentation website which hopefully makes things clearer for new contributors and newcomers to the project.
I've implemented a progress bar on Linux, which is showing up when it downloads a new container image. This was requested by the fine folks from Tails, and I was happy to provide a way to see the download as it comes through.
LLMs
LLMs are really making us change the way we work, especially around vulnerability discovery: because attackers can automate the discovery of security bugs, we have to prevent against them, and we scan our code with this in mind.
(I'm not talking here about using LLMs to write code, but to find security issues)
My general impression is that they make some things look simpler and faster, but it's not necessarily the case. I have a feeling that my brain isn't yet correctly wired for this: I don't know whether they make me lose or gain time.
Automating security scanning is useful, but it's somewhat hard to assess correctly and easy to do poorly / get false positives. Some flagged issues actually don't matter, but it's easy to get tricked into thinking they are (important).
I'm still learning when to trust LLM findings and when to shield against them.
Journalism school trainings
Trainings for wannabe journalists have been prepared. It's been challenging to create this content in a way that's (hopefully) both interesting and not too much for newcomers.
The trainings themselves have been postponed to next February.
Organic plants & seeds
A farmer friend of mine is growing plants for others, and asked me for help in the way to handle invoices, labels and orders.
I've started making a tool that integrates with socléo. It's been interesting to think about the actual workflows and improving them.
We're mid-way trough it, I might publish something as open source when it's over, for others to use. It's written in Elm and runs entirely in the browser.
So far I've been able to:
- Ingest order files from the clients (XLS and CSV)
- Compute and display a planning from these
- Generate labels that needs to be printed each week
- Generate invoices using socleo API.
Computer tools
-
I've made some changes to signal-without-smartphone, adding support for multiple profiles, export/import of the master keys, and more. I thought this tool would go away with the recent changes introduced by Signal, which make their application number-less, but unfortunately it still requires a smartphone for now.
-
Some folks at FPF have been using the threat modeling SSG tool I've worked on in the past, and that's great. I've made some use of it myself to be able to do threat modeling for journalists. I find it currently lacking because it still exposes too much complexity to the end users, but that will probably change. I have been hacking on a threat modeling questionnaire and to-do list generation tool, which I hope to publish soon.
-
I've been playing with smolmachines, which provides a microVM isolation layer for Linux, Windows and macOS. The isolation mechanism is stronger than Podman. I'm looking at that with Dangerzone in mind: the security model would be a bit different than gVisor + Podman. I think it's too early to ship, but I'm keeping a strong eye on it, and have been able to make a PoC with it.
-
TALA is a novel autolayout algorithm designed with software architecture diagrams in mind. If, like me, you're a diagram nerd, you might find it useful.
-
I've made a small contribution to NewPipe, the tool to view and download videos from Youtube (and other places), which wasn't selecting the proper audio tracks in some weird scenarios.
-
I've started hacking my old minitel, to make it work with LoRa radio. The goal is to have it receive and send messages over meshcore, and have multiple of these devices dispatched in the neighborhood.
Conflict resolution trainings
I'm midway trough the year, we just finished the 4th session.
I've been exposed to a concepts that I find enlightening. It's actually two-fold:
- Hierarchical distance: it's the sheer number of layers to go through in order to make things happen. In the workplace, if you need to reach out to your N+1 before reaching out to your N+2, you might have a high hierarchical distance. If you can directly knock at your boss, then you're in low hierarchical distance. In some cultures, one might avoid talking directly to the parents and should first go through the elder child.
Nothing is wrong with either approach; they just reflect different cultures.
- Uncertainty management: how uncertainty is handled, and the communication around it.
You can see it as the way we see and react to "life's bumps". If you're afraid and want to have a lot of control over uncertainty, you might not want to talk about the "issues", whereas if you're open to uncertainty, you might be open about it.
I find this very unlightening, because they are simple concepts who seem to cover a lot of different cases.
Seen, read, listened to
- I've started reading "Je pleure encore la beauté du monde" by Charlotte McConaghy, where you follow a biologist reintroducing wolves in the Scottish Highlands. So far it's been great. I like her writing style.
- I saw Odyssée at the movie theatre, and quite liked it. I like long movies, and honestly for this one I'm not even sure how they managed to make it go by so quickly. I had to go see it because… the name of my conflict resolution training cohort is… "Odyssée"
- Garance was a great time. I went in blind, not knowing anything about the story, and really liked it. It talks about dependency, and… I cried multiple times!
- Series: I've binge-watched multiple ones (Silo, Black Matter), to the point that I think I'll just stop them completely. They weren't bad, but I think there are more interesting things to do in life!
- I went to see Lou Trotignon, a one-man show, and that was… amazing. That really is my kind of humour!
- "No format" released a live album for their 20th anniversary. ALA.NI, Vincent Ségal, Piers Faccini, Vincent Peirani, in one album. Nice!
Energy usage of LLMs
Our GPT-4o case study highlights a core paradox: even modest per-query costs, when scaled across hundreds of millions of daily queries, translate into massive aggregate resource use. This amplifies Jevons Paradox: as AI becomes cheaper and faster, total usage expands, intensifying environmental strain despite gains in per-query efficiency. Without structural shifts in how LLMs are designed and deployed, these invisible costs will continue to rise, threatening to offset the societal benefits that made these systems valuable in the first place.
— How Hungry is AI? Benchmarking Energy, Water, and Carbon Footprint of LLM Inference