kiitos

27 ms·

391.
by kiitos 1y ago
Look, any WAF that blocks a document like <!DOCTYPE html> <html lang="en"> <body> <p>/etc/hosts is a file on Unix hosts</p> is pretty clearly broken. And you can&#x
392.
by kiitos 1y ago
And a rule that denies everything blocks all vulnerabilities entirely. A false positive from a conservative evaluation of a query parameter or header value is one thing, conceivably understandable. A false positive due to the content of a b
393.
by kiitos 1y ago
Directly following is question 4.3: "Are users always prevented from installing programs on end-user devices?" Totally bonkers stuff.
394.
by kiitos 1y ago
> I disagree with other posts here, it is partially a balance between security and usability. You never know what service was implemented with possible security exploits and being able to throw every WAF rule on top of your service does
395.
by kiitos 1y ago
Wow you really hate Terraform! It seems to me that your frustration with Terraform being "completely idiotic" is ultimately frustration with the underlying design model. > If you write configuration to create a Security Group n
396.
by kiitos 1y ago
> Terraform specifically has a flawed model where it assumes nothing in the world exists that it didn't create itself. I don't think this is accurate. Terraform operates against a state snapshot, which is usually local but can
397.
by kiitos 2y ago
Any notion of state that satisfies requirements like > Just dump state and later reapply state is necessarily declarative. > Just dump resources as code, What is the code for this resource? VM foo1 Memory 16GiB
398.
by kiitos 2y ago
This is such a boring perspective. Zero Trust is the spherical cow of trust models. When you do a DHCP request to your local DHCP server, you're trusting that local relationship implicitly. When you PPPoE (or whatever) to your ISP, you
399.
by kiitos 2y ago
But AI didn't get it right. That's the point, isn't it? The screenshot in the link shows an analysis that's based on a set of invalid/incorrect assumptions. Specifically, MCP servers are expected to run in a trusted
400.
by kiitos 2y ago
> I don't find much value in the stdio transport stuff and really only care about the http/sse side ... I found that the docs at modelcontextprotocol.org are somewhat lacking. They seem to assume that you want to use stdio and
401.
by kiitos 2y ago
There seems to be a fundamental misunderstanding at play here. The MCP spec makes it pretty clear that MCP servers are expected to be run in environments that are implicitly trusted/trustable for any client that can reach them. This is
402.
by kiitos 2y ago
> With MCP, we are also adding in <tool description> to that final prompt. Again, it seems we are agreed on that. Interactions with a LLM are session-based, when you create a session there is some information sent over _once_ as pa
403.
by kiitos 2y ago
MCP is literally defined as a protocol. It doesn't have anything to say about the transport layer, and certainly doesn't mandate stdio as a transport. > The main feature of MCP is auth MCP has no auth features/capabilities
404.
by kiitos 2y ago
You're totally right, in that: whatever MCP servers your client is configured to know about, have a set of capabilities, each of which have some kind of definition, all of which need to be provided to the LLM, somehow, in order to be u
405.
by kiitos 2y ago
I've recently written a custom MCP server. > An MCP server is at it's heart some 'thing' that provides a set of 'tools' that an LLM can invoke. A "tool" is one of several capabilities that a MCP se
406.
by kiitos 2y ago
> It is Impossible to add an unlimited number of tools to your agents context without negatively impacting the capability of your agent. Huh? MCP servers aren't just for agents, they're for any/all _clients_ that can speak
407.
by kiitos 2y ago
It literally isn't. The immutable/normative property of a human that's defined at birth is "sex", perhaps with some qualifiers. "Gender" is a mutable/descriptive property that's context-dependent
408.
by kiitos 2y ago
Got it. I think this is, unfortunately, an optimistic, and ultimately anachronistic, perspective on our industry. I think what you describe as "soft-tech people" are in fact the overwhelming majority of junior/entry-level dev
409.
by kiitos 2y ago
Hate to break it to you, but gender is not an immutable/normative property defined forever at birth, it's a mutable/descriptive property evaluated in context. For example, in the year of our lord 2025, Hunter Schafer is a wom
410.
by kiitos 2y ago
> the issues OP describes are a big problem for soft-tech people (muggles) What do you mean by this?
411.
by kiitos 2y ago
> In both cases the idea is the same, we’re configuring the connection, making it behave differently. This is the impedance mismatch. The _connection_ exists at a layer beneath the database/application layer. You're not configu
412.
by kiitos 2y ago
hard no - goto is a feature for code generators, not anything meant for human use
413.
by kiitos 2y ago
vitess is not the answer
414.
by kiitos 2y ago
When someone is trying to communicate some stuff to an audience, it's the responsibility of the orator to ensure the audience understands what they're trying to communicate, it's not the responsibility of the audience to figu
415.
by kiitos 2y ago
I appreciate that! Now maybe they could update the readme accordingly! ;)
416.
by kiitos 2y ago
> Simply change the domain from github.com or github.io to gitmcp.io and get instant AI context for any GitHub repository. What does this mean? How does it work? How can I understand how it works? The requirements, limitations, constrain
417.
by kiitos 2y ago
That may be the case, but the Git notion of a "commit" is a domain concept that is unrelated to, and incompatible with, the distsys notion of a "commit". And terminology like "strict serialization" and "sn
418.
by kiitos 2y ago
I think I'm probably operating with definitions of client and commit that are different than yours. Specifically, I don't really see how a client can "commit locally" and "commit globally" as separate things. I
419.
by kiitos 2y ago
What you've said here is totally different to what the repo docs claim. The guarantees of Graft's "commit" operation are properties of the Graft system itself. If commit is e.g. strict-serializable when clients satisfy o
420.
by kiitos 2y ago
The consistency model doesn't seem to make sense. https://github.com/orbitinghail/graft/blob/main/docs/design.... > Graft clients commit locally and then asynchronously attempt to commit rem

More ›