4 ms·

100% this. The idea that Codex should enforce this is putting the security boundary at the wrong layer. If you don’t want codes to access something, make it so

100% this. The idea that Codex should enforce this is putting the security boundary at the wrong layer. If you don’t want codes to access something, make it so it doesn’t have access.

londons_explore 3mo ago
I could imagine perhaps some system which rather than denying access might instead replace the key material from your .env key with "** redacted. This key material can be used via make, but can never be exfoltrated directly **" whenever that key is seen heading out towards the network...
- brookst 3mo ago
  But that means the process can’t use the key for network requests, right?
- mcintyre1994 3mo ago
  OnePassword can do something like this where you put references to a path there instead of the key material, and then you wrap the invoke command with their CLI and it replaces them. So your local env file never has anything sensitive. A malicious agent could still exfiltrate if you give it access to debug tools on the running code though.
MattDamonSpace 3mo ago
Not sure I agree? It’s not like gitignore should be independent from git
- jxf 3mo ago
  .gitignore doesn't have the same security implications. If you fail to prevent a private key from being added to your repository, you can reverse this and purge it from the blobs and reflog as if it never happened. If you fail to prevent OpenAI from ingesting a private key, you have created a security incident.
  - tmp10423288442 3mo ago
    > If you fail to prevent a private key from being added to your repository, you can reverse this and purge it from the blobs and reflog as if it never happened. Only if you’re absolutely sure that it’s never been pushed to a public repository. I would treat a push of a private key to GitHub as a much higher emergency than it being sent to OpenAI (or even being accidentally used in a Google search), since there are bots that actively scan GitHub for private keys, such that your private key might be found within a few minutes of push.
- TheDong 3mo ago
  The difference is that git is a traditional programming tool which executes deterministically. agents are not deterministic tools, they're not sandboxes or container runtimes or languages with capabilities models. They're a way to run arbitrary commands. It would be like saying that "xterm" should have a ".xtermnoexec" list of commands you can't run, or that VLC should have an option for actors it won't show. terminals run shells which run commands, it's not really deeply aware of what commands your shell ultimately run, and it's not in xterm's job to setup a sandbox and strip out executables. VLC displays pixels, it's not up to it to figure out if those pixels are a certain actor. codex pipes text and tool calls back and forth between OpenAI's servers, and it barely understands what that text and those tool calls are, and especially if a given tool touched a file. If you want VLC to not display an actor, you need to add a layer on top of VLC to stop it displaying a list of movies. If you want codex to not display a file's contents, you need a layer on top of codex to prevent it going near that file.
  - SoftTalker 3mo ago
    bash actually has a "restricted" mode which is sort of like that. In restricted mode, the following are disallowed: - Changing directories with cd. - Setting or unsetting the values of SHELL, PATH, HISTFILE, ENV, or BASH_ENV. - Specifying command names containing /. - Importing function definitions from the shell environment at startup. - Parsing the values of BASHOPTS and SHELLOPTS from the shell environment at startup. ... some other things mainly preventing you from escaping or disabling the restricted mode.
    - 8organicbits 3mo ago
      Does that work? I've never seen it used. It seems easy to escape. The docs seem to suggest using alternate approaches. > Modern systems provide more secure ways to implement a restricted environment, such as jails, zones, or containers. https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html https://www.gnu.org/software/bash/manual/html_node/The-Restr...
      - SoftTalker 3mo ago
- throwatdem12311 3mo ago
  Will git drop your production database because it feels like it when the stars align?
jgalt212 3mo ago
I'm a fan of belt and suspenders.
- albedoa 3mo ago
  Where did you run off to little boy.
  - deleted 3mo ago
    [deleted]
embedding-shape 3mo ago
The Codex bug tracker is a great insight into how wide the knowledge gap seem to be between users. The issue where people ask them to add back /undo or whatever it is instead of just learning to use git, probably reached 100 comments at least by now. People seemingly don't really understand the computers they use on a daily basis, and refuse to learn too.
- tern 3mo ago
  I suspect most people don't even know there's a there there. For instance, while I now know that file systems have permissions, before I became a programmer, I spent maybe ten years thinking of permissions as a special, obscure system thing that you should never touch. For that matter, I suspect many people don't know basic things like that a file system isn't inherently the operating system. And, where would you go to learn this information? Your Mac doesn't ship with a manual—how would you know one exists? Furthermore, I would wager that perhaps most people have never learned how anything works requiring a manual and are simply unaware that that's a thing. All to say, I'm not sure "refusal" is the right term.
  - tingletech 3mo ago
    When I was an undergraduate biology student in 1991 a suitemate told me I should go to some desk in some building over by Muir and get an account on the VAX. There were strange rooms all over campus that were open 24/7 and were loaded with green and amber screen terminals with integrated keyboards. Lots of sessions for CS lectures were held in these rooms and there was always interesting notes on the white boards (most rooms still had black boards or green boards, but think the chalk was too dusty so these rooms usually had the white boards. Once I saw an instruction that was circled with an arrow pointing to is that said: man man man -k -or- apropos and that was how I learned about computers. I just typed `man man` in a terminal on my Mac, and luckily its still there.
  - fingerlocks 3mo ago
    Nit: Your Mac does ship with a manual. Tips.app and of course the man pages. Point stands.
throwatdem12311 3mo ago
You expect Joe Blow vibe coder running Codex on his Dell to understand this?
- matheusmoreira 3mo ago
  Yes.
  - throwatdem12311 3mo ago
    lol I don’t you realize how tech illiterate most normies are
    - matheusmoreira 3mo ago
      It's not that I don't understand, it's that I don't care. Normies routinely hurt themselves trying to do professional work. We don't blame the tools when that happens, we blame the normies.
      - datsci_est_2015 3mo ago
        “You didn’t even watch a single YouTube video before powering up that table saw?”

100% this. The idea that Codex should enforce this is putting the security boundary at the wrong layer. If you don’t want codes to access something, make it so it doesn’t have access.

londons_explore 3mo ago

I could imagine perhaps some system which rather than denying access might instead replace the key material from your .env key with "** redacted. This key material can be used via make, but can never be exfoltrated directly **" whenever that key is seen heading out towards the network...

brookst 3mo ago
But that means the process can’t use the key for network requests, right?
mcintyre1994 3mo ago
OnePassword can do something like this where you put references to a path there instead of the key material, and then you wrap the invoke command with their CLI and it replaces them. So your local env file never has anything sensitive. A malicious agent could still exfiltrate if you give it access to debug tools on the running code though.

MattDamonSpace 3mo ago

Not sure I agree? It’s not like gitignore should be independent from git

jxf 3mo ago
.gitignore doesn't have the same security implications. If you fail to prevent a private key from being added to your repository, you can reverse this and purge it from the blobs and reflog as if it never happened. If you fail to prevent OpenAI from ingesting a private key, you have created a security incident.
- tmp10423288442 3mo ago
  > If you fail to prevent a private key from being added to your repository, you can reverse this and purge it from the blobs and reflog as if it never happened. Only if you’re absolutely sure that it’s never been pushed to a public repository. I would treat a push of a private key to GitHub as a much higher emergency than it being sent to OpenAI (or even being accidentally used in a Google search), since there are bots that actively scan GitHub for private keys, such that your private key might be found within a few minutes of push.
TheDong 3mo ago
The difference is that git is a traditional programming tool which executes deterministically. agents are not deterministic tools, they're not sandboxes or container runtimes or languages with capabilities models. They're a way to run arbitrary commands. It would be like saying that "xterm" should have a ".xtermnoexec" list of commands you can't run, or that VLC should have an option for actors it won't show. terminals run shells which run commands, it's not really deeply aware of what commands your shell ultimately run, and it's not in xterm's job to setup a sandbox and strip out executables. VLC displays pixels, it's not up to it to figure out if those pixels are a certain actor. codex pipes text and tool calls back and forth between OpenAI's servers, and it barely understands what that text and those tool calls are, and especially if a given tool touched a file. If you want VLC to not display an actor, you need to add a layer on top of VLC to stop it displaying a list of movies. If you want codex to not display a file's contents, you need a layer on top of codex to prevent it going near that file.
- SoftTalker 3mo ago
  bash actually has a "restricted" mode which is sort of like that. In restricted mode, the following are disallowed: - Changing directories with cd. - Setting or unsetting the values of SHELL, PATH, HISTFILE, ENV, or BASH_ENV. - Specifying command names containing /. - Importing function definitions from the shell environment at startup. - Parsing the values of BASHOPTS and SHELLOPTS from the shell environment at startup. ... some other things mainly preventing you from escaping or disabling the restricted mode.
  - 8organicbits 3mo ago
    Does that work? I've never seen it used. It seems easy to escape. The docs seem to suggest using alternate approaches. > Modern systems provide more secure ways to implement a restricted environment, such as jails, zones, or containers. https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html https://www.gnu.org/software/bash/manual/html_node/The-Restr...
    - SoftTalker 3mo ago
throwatdem12311 3mo ago
Will git drop your production database because it feels like it when the stars align?

jgalt212 3mo ago

I'm a fan of belt and suspenders.

albedoa 3mo ago
Where did you run off to little boy.
- deleted 3mo ago
  [deleted]

embedding-shape 3mo ago

The Codex bug tracker is a great insight into how wide the knowledge gap seem to be between users. The issue where people ask them to add back /undo or whatever it is instead of just learning to use git, probably reached 100 comments at least by now. People seemingly don't really understand the computers they use on a daily basis, and refuse to learn too.

tern 3mo ago
I suspect most people don't even know there's a there there. For instance, while I now know that file systems have permissions, before I became a programmer, I spent maybe ten years thinking of permissions as a special, obscure system thing that you should never touch. For that matter, I suspect many people don't know basic things like that a file system isn't inherently the operating system. And, where would you go to learn this information? Your Mac doesn't ship with a manual—how would you know one exists? Furthermore, I would wager that perhaps most people have never learned how anything works requiring a manual and are simply unaware that that's a thing. All to say, I'm not sure "refusal" is the right term.
- tingletech 3mo ago
  When I was an undergraduate biology student in 1991 a suitemate told me I should go to some desk in some building over by Muir and get an account on the VAX. There were strange rooms all over campus that were open 24/7 and were loaded with green and amber screen terminals with integrated keyboards. Lots of sessions for CS lectures were held in these rooms and there was always interesting notes on the white boards (most rooms still had black boards or green boards, but think the chalk was too dusty so these rooms usually had the white boards. Once I saw an instruction that was circled with an arrow pointing to is that said: man man man -k -or- apropos and that was how I learned about computers. I just typed `man man` in a terminal on my Mac, and luckily its still there.
- fingerlocks 3mo ago
  Nit: Your Mac does ship with a manual. Tips.app and of course the man pages. Point stands.

throwatdem12311 3mo ago

You expect Joe Blow vibe coder running Codex on his Dell to understand this?

matheusmoreira 3mo ago
Yes.
- throwatdem12311 3mo ago
  lol I don’t you realize how tech illiterate most normies are
  - matheusmoreira 3mo ago
    It's not that I don't understand, it's that I don't care. Normies routinely hurt themselves trying to do professional work. We don't blame the tools when that happens, we blame the normies.
    - datsci_est_2015 3mo ago
      “You didn’t even watch a single YouTube video before powering up that table saw?”