3 ms·

This looks great and seems very well thought out. It looks both more convenient and slightly more secure than my solution, which is that I just give them a sep

by andai 8mo ago

This looks great and seems very well thought out. It looks both more convenient and slightly more secure than my solution, which is that I just give them a separate user. Agents can nuke the "agent" homedir but cannot read or write mine. I did put my own user in the agent group, so that I can read and write the agent homedir. It's a little fiddly though (sometimes the wrong permissions get set, so I have a script that fixes it), and keeping track of which user a terminal is running as is a bit annoying and error prone. --- But the best solution I found is "just give it a laptop." Completely forget OS and software solutions, and just get a separate machine! That's more convenient than switching users, and also "physically on another machine" is hard to beat in terms of security :) It's analogous to the mac mini thing, except that old ThinkPads are pretty cheap. (I got this one for $50!)

lll-o-lll 8mo ago
Where this falls down is that for the agents to interact with anything external, you have to give them keys. Without a proxy handling real keys between your agent and external services, those keys are at risk of compromise. Also. Agents are very good at hacking “security penetration testing”, so “separate user” would not give me enough confidence against malicious context.
- sanitycheck 8mo ago
  So don't let them interact with anything external. You can push and pull to their git project folders over the local filesystem or network, they don't even need access to a remote.
  - lll-o-lll 8mo ago
    Unless you are talking about running a local model, that’s not possible.
    - sanitycheck 8mo ago
      Obviously if you're running Claude Code you need a token for that and an internet connection, that's kind of a given. What I'm talking about is permission (OS level, not a leaky sandbox) to access the user's files, environment variables, project credentials for git remotes, signing keys, etc etc.
sanitycheck 8mo ago
The user thing is what I currently do too. I've thought about containers but then it's confusing for everyone when I ask it to create and use containers itself.

by andai 8mo ago

lll-o-lll 8mo ago

Where this falls down is that for the agents to interact with anything external, you have to give them keys. Without a proxy handling real keys between your agent and external services, those keys are at risk of compromise. Also. Agents are very good at hacking “security penetration testing”, so “separate user” would not give me enough confidence against malicious context.

sanitycheck 8mo ago
So don't let them interact with anything external. You can push and pull to their git project folders over the local filesystem or network, they don't even need access to a remote.
- lll-o-lll 8mo ago
  Unless you are talking about running a local model, that’s not possible.
  - sanitycheck 8mo ago
    Obviously if you're running Claude Code you need a token for that and an internet connection, that's kind of a given. What I'm talking about is permission (OS level, not a leaky sandbox) to access the user's files, environment variables, project credentials for git remotes, signing keys, etc etc.

sanitycheck 8mo ago

The user thing is what I currently do too. I've thought about containers but then it's confusing for everyone when I ask it to create and use containers itself.