My wife and I have a mobile group/shared bot system where we can make mini apps and collab.
Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…
We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN.
Think shared Claude Artifacts that don’t live @ Anthropic.
Tried to first do this with Cloudflare Tunnels (because I love Cloudflare), but between the broken dashboard side of Zero Trust and nightmare of Warp… it was basically impossible to setup. I guess that’s all super enterprise, which seems to be very anti-Cloudflare philosophically to not be able to self do things.
Will check out Quick Tunnels but I think it’s missing the bigger integration offerings Tailscale has/does still.
Tailscale is truly a cheat code. I have a web app that I run locally to control terminals on my Mac. I access the website on my phone using the 100.xx IP address and can code on the go. No need for a Mac or iOS app.
You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet. Be careful using Cloudflare tunnels because they are public and bots start poking around immediately.
Alternatively, Netbird has been a dream to use over the last half year or so. I think their server software has had some hiccups on new releases, but I stagger those updates anyways. All self hosted, similar concept to Tailscale, very good management UI baked into the self hosted product.
Netbird's great. I've been using Pangolin (https://pangolin.net/) lately for my homelab. It's very similar in functionality to Netbird, but I like the UX of it better.
Also a very good alternative. I went on a spree and tried out all of the self hostable alternatives and this was definitely a runner up to netbird. The self hosted tailscale is also good, just not as polished as these two projects are.
For those who use Netbird or Pangolin, I'm trying to understand where it would come in handy over my Wireguard-Easy setup with my phone & laptops configured to connect to my Wireguard network externally.
Is this primarily for multi-user scenarios or complex setups?
Both support multi-user setups with SSO or built-in auth.
Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.
AFAIK, they also have different origins:
Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.
NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.
Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.
I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.
I think Tailscale would've fit my needs perfectly fine, but the management makes access control and grouping dead simple in netbird. It also generates a nice little map of your peers, their groups, and connected nodes etc. Quick visual on your topology.
Tailscale funnel works well but you can only have 1 per Tailscale instance (1 per machine) at the https endpoint so if you want to have a few apps, the others will go on non-https, custom-port URLs.
I have multiple funnels running at once. I just put a tailscale container into my compose stack and that way each compose stack gets its own tailscale instance and thus its own funnel. Happy to share the setup if at all interested.
You can set up paths that route to different local ports. As long as your apps don't need to live at the root path you can have as many as you like. And you can still have something on the root path as long as it doesn't need the subpath.
Wireguard is great for a point-to-point or multipoint VPN set up by a competent network administrator between machines with static addresses. But that's the only thing it does. It does not handle authentication or mobility very well.
No, it’s not. It handles the keys, provisioning, DNS, NAT traversal, and a bunch of other stuff. WireGuard is a great technology - Tailscale is like a usability layer on top of it.
I have the same experience and I once found a GitHub issue about it. I don’t think it sounded like they planned to fix it anytime soon. I just added the Tailscale toggle button to my phone’s quick control panel and turn it on whenever I want to check all my syncthing nodes or something. I keep meaning to see if I can script up something with Shortcuts to make it turn back off automatically.
My endpoint is a pretty stable (though technically dynamic) IPv4 on one end, but the other might be a cell phone with CGNAT, some random WiFi, blah blah etc. TS does that. If you don't want to use it, cool. Don't. I'm willing to make the tradeoffs to use TS for now. That could change in the future.
Not OP- I think there’s been some cool solutions popping up around hosting personal apps. On the front page this week was Capsule (https://withcapsule.app/). My personal solution is Exhibit (https://github.com/momja/Exhibit) which also has the goal of being a self-hostable artifact store.
I have my own solution here that also works for sharing stuff with clients with configurable whitelists at artifacts.iofold.com (also open-source for self hosting on cf workers for almost free, github linked on the homepage)
I’ve been building something similar with [Homestead](https://myhomestead.dev). It’s my OSS solution for building mini apps. Each mini app is a Resct frontend and the backend (storage, auth, MCP, API, etc) just comes for free.
I’m not GP, but run something that’s pretty close to GPs description. It’s been a fun journey to set up.
The core is chat+audio/video call server running locally on my m3 Mac Studio. Centrifugo has handled the chat concerns very well. LiveKit was a really nice foundation for video and audio calls. There are a few different options for local STT if you want that.
I used RN via expo for the client and have my friends and family on TestFlight as beta testers. Utility over polish.
With messages and call transcripts on my own box, I can prompt Claude code or Codex to operate on any message or transcript content. And follow up in chat with a message. I do most of that from Claude or ChatGPT mobile apps via remote control to my sessions running in the box.
From there, if I give enough of a specc, anything that happens in chat or call transcripts can become an additional custom workspace in the main app. I think GP calls these mini apps. But they’re essentially rich clients under the main app umbrella. There’s other details, but yeah it’s a strange new world. Check my profile and reach out directly if you want.
I use public dns routed to private Tailscale ips for all my home services. If i want to expose something for friends who don’t use Tailscale I connect a cloudflare tunnel… it’s pretty much a couple clicks and typing in a subdomain name once cloudflared is running on a server… what were you having trouble with?
I would say that I've been doing most of that already with a reverse proxy+SSO/IDP for a very long time. Not the same, but close-enough and open to the "traditional internet" in a manner that does not require my users to install and configure tailscale, which is a massive plus. I do appreciate tailscale for the option to keep my effective host IP address hidden/local, but then I've been having a front on the internet (with a public IP/domain/...) for decades and I don't see a problem continuing.
> it’s missing the bigger integration offerings Tailscale has/does still.
Until I had tailscale serve generating valid certs, I had a good reason to use Cloudflare tunnels.
But in general I don't want to put everything on the internet side of things.
Mostly, I don't want something open, but more like a "share with" for people who are in the same office (virtually over tailnet, not physically on the same LAN).
This still works great for a demo instead of a product pitch, to send an link out to see something.
I'd still use a real host over a laptop for those.
Only reason I have it (cloud flare tunnels) setup for personal use is because I had to do it for work years ago and yeah, Enterprise(tm) is a good description, haven't touched it in years so when it breaks I'll likely use something else.
Getting it to do what I wanted with a traefik front router with cloudflared talking to arbitrary subdomain that is spun up and broadcast from the other project side was very painful in a "this could be more friendly" way.
It has been truly bulletproof though since then so that's almost enough to make me go reread all the docs.
I have really enjoyed the experience of OpenZiti for this purpose. Being able to host dark services and impose granular access controls and routing for different clients is a game changer.
For the few services I host that require SSL (eg; WebUSB), I serve the dark service via a standard domain (example.com) so I can still get a LetsEncrypt cert, but public access to that domain resolves to a static page; "Plz connect to OpenZiti & try again". This allows me to have SSL on required dark services without requiring to install a private CA for each client.
> Think shared Claude Artifacts that don’t live @ Anthropic.
Shameless plug, I've built a self-hosted capability here with things like live collaboration for humans and agents. There is a native cloudflare deplyoment and integration with Cloudflare Artifacts. PR for tunnel would be appreciated.
Us too, consider using your bots to migrate your tailnet to headscale. Daily driving Headscale + Headplane + Tailscale’s graciously provided/compatible native apps makes me feel like my devices are truly under my control.
If only headscale supported tailnet lock and multiple control servers. They consider both features "enterprise" even though the former is arguably a bare minimum and the latter nice even for home users in the event their lab gets taken offline.
Does this work with remote agents though? I want my claude.ai agents running on my phone to be able to hit my local MCPs on my Mac Mini - my understanding is that tailscale wouldn't work because the execution is being called remotely. But seems like these tunnels would support that.
If by local MCP you mean stdio, then a tailnet won't help you unless you proxy the local MCP using something like mcp-proxy: https://github.com/sparfenyuk/mcp-proxy . That local mcp is only exposed to apps on the machine.
The flow is Phone client --> agent harness or whatev --> Tailnet --> Mac Mini --> mcp-proxy http listener --> local mcp. But you need to wrap the local mcp runner in the proxy (check the docs).
EDIT you don't mean running on your actual phone lol, you mean in the web browser at Claude.ai. Anyway, if you use mcp-proxy for a stdio mcp, or if it's an http mcp alone, then you would need a public endpoint for Claude.ai to connect to. Tailscale will only help you if you use Funnel, but this cloudflare thing is exactly what you need (w/o Tailscale).
if both your mac mini and your phone are on the same tailnet, can't you just ssh to your mac mini from your phone's terminal emulator and have claude code/codex run on it?
I just use /remote-control. You can't do everything from remote but it's was easier just opening the Claude app than using ssh. And I don't need to be on my tailnet either.
I run something similar, and in my system an app artifact is typically just a rich react component in a React Native client. They usually start as prototypes in chat, similar to what the labs provide in their native apps. If I or someone else in my user group wants more depth than a chat widget, then the artifacts can grow into a “workspace”. Oddly enough my richest workspaces have most been for entertainment. DnD, MtG deck building, HN comment thread parsing. And system management. Intrusion detection, feature life cycle/LLM handoff management, call telemetry. I do have a workspace for public county permit lookup which has been handy too. Reach out and I can share more.
Don't think we had any issues with Warp but Cloudflare APIs are a bit of a mess. Seems like they've cobbled together and then renamed/rearranged things multiple times now and it's a bit hard to keep up.
Terraform has worked decently well especially since there's a few random settings here and there that aren't exposed anywhere in the UI (facepalm)
I don’t know. I personally wouldn’t take it if you aren’t also working out/lifting frequently (even if you drink a ton of water).
Anecdotal so safe to ignore this… but my hair did thin out but only after I was lazier on my work outs. Stopped taking and hair mostly returned to normal thank God.
Antacids did this to me. I was convinced it was electrolytes, would take supps etc but I believe it came down to calcium absorption. Taking a break from the antacids immediately stopped the cramping.
The reason I asked is that creatine will allow you to lift a bit more (a little more weight, a few more reps). This will cause more muscle fatigue which in turn can lead to more cramping. Water and electrolytes can help, but when the muscles are fatigued they are still more likely to cramp.
> but my hair did thin out but only after I was lazier on my work outs.
How old are you?
Also, working out helps reduce stress. Does it seem more plausible that getting lazier on your workouts, rather than the creatine, increased stress in your life, thus the hair thinning?
I have never heard of creatine causing thinning hair.
I noticed hair thinning too. To be clear I don’t know that creatine caused it. But what feels like a longer period of thinning (I’m 43) coincides with creatine use. It’s not a well-documented side effect if is indeed real.
I like creatine when I’m lifting because it reduces soreness. For some people that effect helps them push further and train harder, for me it’s just proactive pain relief
It's not only tenable, it is a necessity. Unless you want humanity to be enslaved in perpetuity to a single figurehead.
Bad AI is only countered by having a majority of good, open-access and open-source AI to keep it in check, where the good AI can overpower the bad. The moment you destroy that balance is the moment a bad actor gains exponential advantage and the ability to hold the whole world hostage forever.
It certainly falls under 1st amendment protection since LLMs are about accessing speech. But that hasn’t stopped Dario from trying hard to push for regulations and bans that limit our civil rights. He and Sam Altman want regulatory capture at the expense of our right to free speech.
Don’t legally serious second Amendment supporters regard “arms” as things that can be carried, and are evolved from/analogous to their 18th century hand-carried guns?
It would be hard to classify AI (or tanks, artillery, missiles, aircraft) as “arms” that can be “borne” in that sense.
And? Computers are dual-use. Cars are dual-use. Telephones are dual-use. Freeze-dried chicken is dual-use.
Single-use, i.e. military only technology is actually pretty rare.
> This kind of posture is simply not tenable as frontier intelligence increases.
I reject the corpo speak that tries to brand these things as being "intelligent." They can be useful. But a language model cannot conjure a weapons platform from the ether no matter how "intelligent" it is.
This is precisely the issue. It took a fair amount of idealism, conviction, and commitment in order to create the open source movement and bring it to where it is today. In contrast, most skilled data science practitioners are just chasing IPO exits these days.
Prefacing that I assume this order is done with ill intent, and would guess that it’s based on Anthropic not bending the knee immediately like OpenAI did.
But your statement could be rephrased as
> The most ethical goal of a weapons manufacturer or government should be to bring the maximum number of nuclear weapons for as cheap as possible to the people equally.
Making sure everyone is a strapped as possible only makes sense to the type of libertarians who salivate at the idea of shooting someone who steps on their property to deliver a letter
The dream has always been a first-class framework for Cloudflare Workers.
- In the earliest days (literally go read their blog posts and GitHub repos), they only ever really did dinky little demo's.
- After and for the longest time, they tried to claim they went "Full Stack" with SSR-able abilities, but they were so terrible back then and not even well integrated into their Worker platform tools.
- This was oddly gray mixed (sometimes?) with Pages messaging which definitely was not full-stack in the sense developers wanted.
- Then getting any of this to work in a dev environment was super difficult as "wrangler dev" was very limited (wrangler is so good now FYI).
- Vercel just kind of ate Cloudflare's lunch here. No shame in it. They just couldn't get it right for developers period.
- Then very quietly "Adapters" came around and basically changed the game. Your code base finally felt portable to Workers with essentially full CF platform support.
- Now we live in AI-age and they bought Astro (?), tried to launch WP clone (?), and vibe-coded Next (?)
Big and long time coming for all of this. It is a super breath of fresh air to see even more improvements will likely come to Workers. Icing on cake is Evan is a legend who has a proven track record of delivering tools people love.
Opus is so bad at electrical work it's really disappointing. And when it tries to draw schematics as SVGs it's a complete disaster. They should either focus on training their LLMs on this task specifically, or have it refuse.
Hmm, what kind of electrical work? I had it "watch over my shoulder" as I swapped out the pressure switch on our home well and it was a big help. And in the run up to that when I explained opening the 220 box and checking that was "above my paygrade" it limited our investigation to just the less sparky parts.
have it write python porogram to generate the svgs. then use the program. circuit diagrams are rrlatively thin corpus but it knows how ciruits work sufficently to write a program.
Seems like they might be hinting that if you are not a billionaire or multi-billion dollar company you will just get a limited and nerfed Claude Code slash command /mythos-security-audit or something.
Hope this isn’t the case and that normal average Joe’s of the world don’t get policed out of access.
> you will just get a limited and nerfed Claude Code slash command /mythos-security-audit or something.
Unless it's so expensive that we can't realistically use it for anything, I wouldn't complain about getting at least that. I would also rather have the actual model, but that's a useful application of it (and I'm probably not going to afford using it for much more).
Price discrimination is I think fine and reasonable so long if you can drum up the cash you can use it how you want within their ToS.
Although mental safety gymnastics aside, getting the most amount of intelligence for the cheapest amount of cost to normal people seems like the most ethical thing a big lab could do.
Going around and granting different tiers of intelligence to different insiders, friends, or companies is majorly problematic long-term.
Heck right now, the tokens you buy today for “Opus 4.8”, no one even knows or believes will be the same “Opus 4.8” just 3 days from now.
/security-review already exists so I don't think it would be crazy to have a /mythos-security-review as more thourough command as well. I think it's more likely it is going to be released at some point to the general public though - although the the pricing might make it quite unattractive.
It's not just better at cybersecurity, it's better at all the things (or most of them). I for one would really benefit from a better claude code. I still have to babysit it pretty closely to keep it from messing things up. Opus 4.7 was not an upgrade for me.
But in general, what does the average Joe need Opus for that Sonnet or Haiku can't do for them? Better is better.
Isn't OpenAI's public flagship already beating Mythos on penetration testing? I get the impression Mythos is just valuation-juicing for IPO more than anything else.
The fact that they haven't released it yet suggests a cost/margins issue to me more than anything else. Short term, I'll probably keep using Antrhopic, but my long-term bet is that locally-served models win, if only because the quest for profitability will probably lead to intentionally-nerfed / enshittified frontier models.
At other vendors, ad placement within LLM responses is either coming or already here. Anthropic's handling of OpenClaw shows they're willing to engage in anti-competitive behavior, and the courts are not in a hurry to stop them. Why would I pay them $200 a month for such treatment when a $2K box does what I need locally?
Mythos is dramatically better specifically at finding zero-day vulnerabilities and developing exploits for them, that being what it was designed to do. On other cybersecurity tasks, GPT-5.5 is at least as good, but finding and exploiting zero-days is a particularly scary capability, which is why Mythos is a big deal. See, e.g., https://forum.effectivealtruism.org/posts/8yztpbjuPkyXsmA6n/....
We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy. The same improvements that make the model substantially more effective at patching vulnerabilities also make it substantially more effective at exploiting them.
I've been assuming that Mythos is just a big jump in model size, and that's where the jump in capabilities comes from. Hence I expect OpenAI not to be able to catch up without scaling up the model and hence significantly raising the API prices.
Anthropic frames this as something emergent. Not 100% but in a way they always phrase it as like, it’s a great model, but our breaths were swept and taken with its approach to security.
A lot of people have spent a considerable amount of time building out "claude -p" workflows trusting Anthropic because of those same Tweet assurances outside of OpenClaw.
It seems with the new "--bare" flag they are introducing, a huge rug pull is coming as they plan to deprecate -p for unlimited users.
The docs now read:
> "Bare mode skips OAuth and keychain reads. Anthropic authentication must come from ANTHROPIC_API_KEY or an apiKeyHelper in the JSON passed to --settings. Bedrock, Vertex, and Foundry use their usual provider credentials. --bare is the recommended mode for scripted and SDK calls, and will become the default for -p in a future release."
Hope I am reading this wrong or this is clarified.
It seems clear that Anthropic wants users pay API rates for tokens when use in a programatic way, and not subscriber rates for tokens when used from code. As a user, I want to pay the subscription rates with -p, but it seems they want to block that.
Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…
We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN.
Think shared Claude Artifacts that don’t live @ Anthropic.
Tried to first do this with Cloudflare Tunnels (because I love Cloudflare), but between the broken dashboard side of Zero Trust and nightmare of Warp… it was basically impossible to setup. I guess that’s all super enterprise, which seems to be very anti-Cloudflare philosophically to not be able to self do things.
Will check out Quick Tunnels but I think it’s missing the bigger integration offerings Tailscale has/does still.
reply