4 ms·
Well, isn't it like Yolo mode from Claude Code that we've been using, without worry, locally for months now? I truly think that Yolo mode is absolutely fantasti
by robinhood 1y ago
Well, isn't it like Yolo mode from Claude Code that we've been using, without worry, locally for months now? I truly think that Yolo mode is absolutely fantastic, while dangerous, and I can't wait to see what the future holds there.
- bicx 1y agoI run it from within a dev container. I never had issues with yolo mode before, but if it somehow decided to use the gcloud command (for instance) and affected the production stack, it’s my ass on the line.
- ses1984 1y agoIf you give it auth information to talk to Google apis, that’s not really sandboxed.
- cj 1y agoI don't use claude and googled yolo mode out of curiosity. For others in the same boat: https://www.anthropic.com/engineering/claude-code-best-practices#:~:text=for%20best%20results.-,d.%20Safe%20YOLO%20mode,-Instead%20of%20supervising https://www.anthropic.com/engineering/claude-code-best-pract...
- adastra22 1y agoRun it within a devcontainer and there is almost no attack profile and therefore no risk. With a little more work it could be fully sandboxed.
- roywiggins 1y agoYou still have to be pretty careful it doesn't have access to any API keys it could decide to exfiltrate...
- adastra22 1y agoHow would it have access to API keys? You don’t put those in your git repo, do you?
- jazzyjackson 1y agoIf the code can call a method that provides the API key, what would stop the LLM from calling the same code? How do you propose to let an LLM run tests that execute code that requires API without the LLM also being able to grab the key?
- adastra22 1y agoI don’t give it access to calls requiring API keys in the first place. This is just good dev environment stuff. Have locally hosted substitutes for everything. Run it all in docker.
- jazzyjackson 1y agoI shudder to think of what my friends' AWS bill looks like letting Claude run aws-cli commands he doesn't understand