5 ms·
wait so just being lazy and using sudo on Docker commands instead of figuring things out actually means I'm being safer? awesome.
by HeWhoLurksLate 4mo ago
wait so just being lazy and using sudo on Docker commands instead of figuring things out actually means I'm being safer? awesome.
- SpaceNoodled 4mo agoThis feels like using Docker is just inherently unsafe.
- itintheory 4mo agoThis feels like using sudo is just inherently unsafe.
- alsetmusic 4mo agoThis feels like using a computer is inherently unsafe. On the plus side, once we outlaw them we'll shut down the ability for conspiratorial thinking to spread easily and the world will slowly heal from the last couple of decades (the previous one in particular). Hooray! We're finally doing something about the harms of social media. Smash your computer today!
- LeFantome 4mo agoSafety meeting. Nobody works, nobody gets hurt.
- b65e8bee43c2ed0 4mo agoI think we're only a few decades away from these things being said unironically.
- TheRoque 4mo agoIt's already here, mobile OSes are just computers with ton of guardrails and you can't do whatever you want with it, for the sake of security. I mean we almost got an Android where you can't install the APK you want.
- rmunn 4mo agoWhere's that guy with the ButlerianJihad username when you need him?
- DANmode 4mo agoAh yes, it’s the conspiratorial thinking dividing society, not humans being humans, not the people at the highest echelons of society being corrupt (Epstein called). It’s the people trying to piece that evil together so they know what to tell their kids - they’re the problem. Sure.
- gruez 4mo agoThis but unironically. There's no way to ensure that nobody overwrote your .profile or .bashrc with a backdoored sudo that steals your password, or runs your command and then runs an evil command afterwards.
- zahlman 4mo ago`which sudo`? `/usr/bin/sudo`?
- bestham 4mo agoIf they can override sudo, they can override which.
- antonkochubey 4mo agoif you use \which it'll always be a shell built-in ;) though someone can put a different shell in your .zshrc
- jjmarr 4mo agoIt is. That's why SELinux and AppArmor were invented. Instead of having "root" and "user", both of these provide sets of permissions that can be granted to apps. In this case, SELinux would've stopped this. Codex could've still relabelled the files when mounting but this can be blocked for sensitive directories like /etc.
- dymk 4mo agoThat’s what rootless docker is for
- antonkochubey 4mo agorootless docker's networking (slirp4netns) is still terribly buggy and in edge cases often locks up using 100% CPU until you discover that your laptop is a lapwarmer and kill it
- Helmut10001 4mo agoI found it pretty reliable and use it across all my docker projects, development and production.
- LeFantome 4mo agoThe fact that Docker is unsafe was one of the core motivations for Podman.
- Leynos 4mo agoWas gonna say, "why not podman?"
- vitally3643 4mo agoYes, that's why they warn you about it.
- hgomersall 4mo agoNo, using AI tools not in an effective sandbox is inherently unsafe.
- cassianoleal 4mo agoBoth can be true.
- NotPractical 4mo agoNo, because a malicious AI agent could just replace the sudo binary in your path with one that collects your password and uses it to execute arbitrary code as root. Nothing short of sandboxing everything or just never using AI agents or proprietary software will prevent this.
- lucaspiller 4mo agoMy agent has access to my email, my messages, my work, my finances, my life. But thank god it doesn't have access to root on my machine.
- mmh0000 4mo agoAs always. XKCD: https://xkcd.com/1200/ https://xkcd.com/1200/
- gopher_space 4mo agoOnce I noticed that models will treat lack of superuser access as an obstacle I moved all of the agent crap to its own machine. Watching some mid-tier offering chain together tools like its a gorilla escaping the zoo and I'm just not going to deal with that situation.
- overfeed 4mo agoI'm more worried about my `~/.aws` and `~/.ssh` folders. People who use IDE-based AI tooling with IDEs that support dev-containers have no excuse for not leveraging dev containers, both for preventing agents losing your data and defending against secrets-harvesting supply-chain attacks
- saidnooneever 4mo agofunily less is often more in security while ur devving. but its best to be aware rather than lucky :p