coder-pm

5 ms·

1.
by coder-pm 5d ago
Nice setup, I'm curious about the PAT. Even fine-grained permissions are working till the expiration so if the box will die someone has it for the whole time. Did you rotate it per session or it was on default expiration time?
2.
by coder-pm 9d ago
It makes sense for a personal project. The fix should be accomplished as a standalone role or scoped credential per user. Once this is done the prefix will be a real boundary, not just a name. Good luck with that, nice project!
3.
by coder-pm 12d ago
If the server is compromised, it still receives the real key on each call. If the vault issues a long lived key, e.g. GitHub PAT, one call will expose it forever. Does the vault issue short lived keys or the stored one?
4.
by coder-pm 12d ago
I have read the template and all the microVMs are running under the same role which has read and write access to checkpoints/*, so every user's folder in the bucket. The prefixes for users are just names, not boundaries. What stop
5.
by coder-pm 16d ago
This looks like a gate before calling a tool but you’re saying your goal is not to containerise it. In that case what would stop the allowed call from, for example sending something outside? Is there something else sitting alongside the gat
6.
by coder-pm 16d ago
This makes sense for stateless workers, which don’t have to keep the context between the steps. What about the interactive agents, holding ssh session or repository state between the steps? That’s a different case, isn’t it?
7.
by coder-pm 16d ago
That’s kind of similar to what I am doing right now. I’m building a sandbox for agents with egress control using a domains allowlist. Is it possible to control egress in that proxy, per agent, per domain? Or is it giving a full access to th
8.
by coder-pm 16d ago
I'm not generating the mutations automatically. Every one is a single targeted change assigned to a single test, reviewed one at a time. Thanks to that changes that mean the same thing don't stack up. The cost is reversed, I only
9.
by coder-pm 18d ago
Yes, automated and gated. Zero missed rather than percentage. This morning harness failed the agent written test that passed on the fixed code and also passed against the mutated code. Test looked fine, code reviews would approve it, only t
10.
by coder-pm 19d ago
Hm and does name mapping still work if the user is using docker compose? it creates a user-defined network and resolv.conf is 127.0.0.11 rather than the host resolver
11.
by coder-pm 20d ago
This is great, I was already doing research in that area for my tool. What about a container that writes to the /etc/hosts? It won’t emit DNS queries at all and because of that the connections will show up as bare IPs without doma
12.
by coder-pm 20d ago
Answers are in the article , agents used SSH tunnels, it was evidenced by the wiki’s referrer logs. The Tor - agents did edit the wiki via SOCKS and relay R6 instantly. The questions should be more like was CONNECT open or they didn’t even
13.
by coder-pm 21d ago
I think the biggest loss is now not knowing if what the agent is claiming was actually done:) but yes, right tools are necessary, adding a boundary will change the position, being out of touch will be recoverable. Otherwise one bad call mig
14.
by coder-pm 22d ago
Oh so it’s about the platform where it lives, not about the logic, fair enough. Porting logic as is looks like the best approach, the one thing that broke wasn’t really logic:)
15.
by coder-pm 22d ago
A hostname based egress allowlist is only worth as much as the box’s control over name resolution. If the agent can modify hosts inside the sandbox then it’s not a protection at all
16.
by coder-pm 23d ago
Ok but if assembler normalises encoding then a byte diff won’t prove anything. Behaviour check is the way.
17.
by coder-pm 23d ago
Nice, so it works quite good! So it’s a port, not a re-implementation. Good job on that, I like it that way:) do you have an idea why the trampoline jump didn’t come across?
18.
by coder-pm 23d ago
Hmm did you ever run the game port against the original one in UAE? With the same inputs? Or is it just "it plays right when I play it"? That 108 byte delta is puzzling...
19.
by coder-pm 24d ago
Nice trick with the structures, good for agent legibility! I will try it out on the right occasion:)
20.
by coder-pm 24d ago
The ttyd and playwright is a clever differential way, personally I’m doing the same when it’s about to compare the views (or fix something related to rendering). Good job on that! A TUI editor’s real output is the bytes stored on disk, whil
21.
by coder-pm 24d ago
Agree on the validation, my loops are already gated. My concerns are about the cases when model is passing validation and quietly abandoning the goal. The second scenario is rewriting the plan to fit what was already done.
22.
by coder-pm 25d ago
This is impressive but it again led me to questions. Porting the fuzzer from Go to Rust to validate Rust is a bit circular, isn’t it^^? Porting a fuzzer bug will hide the same class bug in the code it’s checking, who fuzzes the fuzzer &#x2F
23.
by coder-pm 25d ago
How much did the verification cost on top? how did you gate it? was it a Go test suite you ran against the Rust or what? I always wonder how ppl are testing these rewrites, rewriting the tests can also lead to bug. I really wonder how relia
24.
by coder-pm 25d ago
That kind of one shot capability is impressive but how does it work for my typical work style? The way I work is to build a huge roadmap with goals and hand it to my agent to execute (often over night). I don't care that much about the
25.
by coder-pm 26d ago
Fair precision, obviously Cloud runs are executed remotely. Since both cloud and local runs cannot be distinguished, users genuinely won’t know when their filesystem will be touched. Basically you can’t safely depend on the user telling the
26.
by coder-pm 27d ago
Non devs running something might not be aware the programs runs locally and touches the actual machine. Devs know to be careful but regular users won’t even have knowledge it’s touching their machine, filesystem and might even touch the cre
27.
by coder-pm 27d ago
Yes, it’s just CLAUDE.md instructing agents. The point is to correctly define it and adjust to your needs
28.
by coder-pm 27d ago
The attackers pull the key from live process, not from disc so neither chmod nor disc defences method will work. The right fix is to keep the keys out of the runtime! Entirely! It’s even mentioning they are detecting the agent framework so
29.
90 days of attacks on AI infrastructure(wiz.io)
1 points by coder-pm 27d ago|1 comments
30.
by coder-pm 28d ago
Hah in the AI era I noticed the agents are worse than the average person at noticing bugs. Agents use their own scale to decide if something is a success even if the output is broken. Agents are bug-blind to their own work. The consequence

More ›