3 ms·
I'm more worried about my `~/.aws` and `~/.ssh` folders. People who use IDE-based AI tooling with IDEs that support dev-containers have no excuse for not levera
by overfeed 4mo ago
I'm more worried about my `~/.aws` and `~/.ssh` folders. People who use IDE-based AI tooling with IDEs that support dev-containers have no excuse for not leveraging dev containers, both for preventing agents losing your data and defending against secrets-harvesting supply-chain attacks
- l23k4 4mo agoUsing containers as a security boundary is inexcusable.
- koolala 4mo agoIt is excusable if all you care about is blocking sudo access while letting the ai use a pseudo sudo.
- rafterydj 4mo agoCould you elaborate on this?
- l23k4 4mo agoThe cost-benefit ratio of using VMs over containers is very high. You trade negligible overhead for an actual security boundary. Containers don't provide good isolation and tend to be trivial to break out of.
- overfeed 4mo agoThat entirely depends on one's threat-model. Also, containerization is 100x better than rawdogging.
- l23k4 4mo ago> That entirely depends on one's threat-model I think not, virtualization has such low overhead now that there's just no excuse. It's generally trivial to switch from containers to VMs.