It's amazing how often product decisions head this way for the purposes of 'removing friction'.
In security, friction is a GOOD thing. You want to have some ceremony to do things. It's pretty much inevitable that people will give up control for convenience.
Look at Artifacts for example.
show comments
Lukas_Skywalker
The Bitwarden desktop app has a built in SSH agent [1], which lets you store SSH keys inside Bitwarden. I have set the app to always ask me for confirmation when the key is requested.
I'd suggest to use ssh keys inside the secure enclave on macOS that require your fingerprint for every new session [0]. That way agents cannot initiate anything, and you will always be aware when a new ssh connection is being made.
I don't understand what the linked pull request is supposed to prove, considering it was closed and not merged.
carterschonwald
this is a normal ssh feature meant to allow keys to be used while keeping keys local …
its actually a keystone of secure infrastructure setups, aka jump hosts.
granted its meant for human or scripted uses, as is everything else
show comments
m000
At this point, should cases like this even be news? Isn't that a fundamental security design issue? Local agent security guardrails appear to always be built around blacklists, which will always be unreliable and leaky. It is left as an exercise to the user to properly sandbox them.
There may be some limited form of whitelisting, but often it is just a facade, as it is very coarse-grained. So, with tools with very broad capabilities (ssh, kubectl, gcloud, etc) you end up with the agent performing unwanted actions.
Same for [devpod](https://devpod.sh/) for sshing to devcontainers. They are particularly annoying because they just dump it into your config. Use an include statement to your own file for goodness sake.
It was often not ideal in the old world. Now agents are doing everything in those boxes, it is kind of mad.
I have my own utilities now for managing these sockets and files now to deal with this stuff.
VCFundedGenYer
Regular reminder to never download/install AI chatbot apps - they all work in a browser where they can be isolated.
Do not let these things loose on your computer.
show comments
simoncion
This sucks, a lot, but you've gotta never run these tools as your ordinary daily-driver account. These tools are rather unpredictable and -because of the nature of the incredibly reckless development methodology- it's nearly impossible to understand every behavioral change in new versions of the ones that are largely or entirely vibecoded. [0]
As others have said, it looks like the primary way the Major LLM Manufacturers have chosen to control these things is with a combination of great big blacklists and voluminous pleading, begging, and scolding. Most of us know the problems both with enumerating badness and with attempting to appeal to something that's incapable of care, sympathy, or shame.
[0] For another example of this principle, go read the recent Jepsen report on ParticleDB.
aweiher
What exactly does this five-month-old never-merged PR prove besides that 90% of people on HN are just reading the headline?
betterunix2
Another example of OpenAI giving little thought to security because they want "iteration speed" or whatever.
It took decades of work just to bring Internet security up to the state it is (was?) in at this point, and it is hardly where it should be. AI adds new security concerns (e.g. prompt injection) that need to be addressed and we do not have great answers to that. Bringing us back to the state of security we had in the 90s while adding new problems might be the most shortsighted decision imaginable...
throwa356262
Doesn't matter how many 0-days chatgpt can find in the linux kernel when it also pulls things like this.
Whoever told you AI has solved security was hallucinating.
Betelbuddy
They might have solved coding but they did not solve common sense.
show comments
iririririr
or "users running a program whose purpose is to eval commands received from a remote service, shocked that readable credentials are being read"
anyone who thinks THIS is the security problem is mental.
spwa4
Of course it does. That's what the codex <> chat merge is actually doing.
But codex <> chat merge is what they're giving as the "real reason" for what actually is raising prices (a LOT, I might add) for all the subscriptions. Nobody wants it (certainly not applied globally to everything like it is), but they're still going to do it. I even know someone who works at OpenAI and there's apparently a few people trying to fight it at least internally.
Given Sam Altman's speech about how he wants OpenAI pricing to work, I don't think this can be stopped. Btw: that is that you type something into ChatGPT and instead of subscription or per-token cost or anything like that, as soon as you type something in, anything, the way he sees it, ChatGPT would give you a cost for that specific answer and you'd agree or not.
I just feel like this guy is an even worse example of not seeing the viewpoint of a normal (you know non-millionaire) person than even Google's leadership. Can I just say "I think Google is going to win from Altman", you know, despite OpenAI having the far superior technology. Because if there's one guy in the whole world that can destroy the advantages of OpenAI's engineering accomplishments for everyone else, it's this guy ...
It's amazing how often product decisions head this way for the purposes of 'removing friction'.
In security, friction is a GOOD thing. You want to have some ceremony to do things. It's pretty much inevitable that people will give up control for convenience.
Look at Artifacts for example.
The Bitwarden desktop app has a built in SSH agent [1], which lets you store SSH keys inside Bitwarden. I have set the app to always ask me for confirmation when the key is requested.
[1] https://bitwarden.com/help/ssh-agent/
I'd suggest to use ssh keys inside the secure enclave on macOS that require your fingerprint for every new session [0]. That way agents cannot initiate anything, and you will always be aware when a new ssh connection is being made.
[0]: https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb...
I don't understand what the linked pull request is supposed to prove, considering it was closed and not merged.
this is a normal ssh feature meant to allow keys to be used while keeping keys local …
its actually a keystone of secure infrastructure setups, aka jump hosts.
granted its meant for human or scripted uses, as is everything else
At this point, should cases like this even be news? Isn't that a fundamental security design issue? Local agent security guardrails appear to always be built around blacklists, which will always be unreliable and leaky. It is left as an exercise to the user to properly sandbox them.
There may be some limited form of whitelisting, but often it is just a facade, as it is very coarse-grained. So, with tools with very broad capabilities (ssh, kubectl, gcloud, etc) you end up with the agent performing unwanted actions.
Things are awful for this at the moment. [Was the same for docker desktop at some point.](https://rupertrutledge.com/posts/docker-sbx-s-ssh-security-i...)
Same for [devpod](https://devpod.sh/) for sshing to devcontainers. They are particularly annoying because they just dump it into your config. Use an include statement to your own file for goodness sake.
It was often not ideal in the old world. Now agents are doing everything in those boxes, it is kind of mad.
I have my own utilities now for managing these sockets and files now to deal with this stuff.
Regular reminder to never download/install AI chatbot apps - they all work in a browser where they can be isolated.
Do not let these things loose on your computer.
This sucks, a lot, but you've gotta never run these tools as your ordinary daily-driver account. These tools are rather unpredictable and -because of the nature of the incredibly reckless development methodology- it's nearly impossible to understand every behavioral change in new versions of the ones that are largely or entirely vibecoded. [0]
As others have said, it looks like the primary way the Major LLM Manufacturers have chosen to control these things is with a combination of great big blacklists and voluminous pleading, begging, and scolding. Most of us know the problems both with enumerating badness and with attempting to appeal to something that's incapable of care, sympathy, or shame.
[0] For another example of this principle, go read the recent Jepsen report on ParticleDB.
What exactly does this five-month-old never-merged PR prove besides that 90% of people on HN are just reading the headline?
Another example of OpenAI giving little thought to security because they want "iteration speed" or whatever.
It took decades of work just to bring Internet security up to the state it is (was?) in at this point, and it is hardly where it should be. AI adds new security concerns (e.g. prompt injection) that need to be addressed and we do not have great answers to that. Bringing us back to the state of security we had in the 90s while adding new problems might be the most shortsighted decision imaginable...
Doesn't matter how many 0-days chatgpt can find in the linux kernel when it also pulls things like this.
Whoever told you AI has solved security was hallucinating.
They might have solved coding but they did not solve common sense.
or "users running a program whose purpose is to eval commands received from a remote service, shocked that readable credentials are being read"
anyone who thinks THIS is the security problem is mental.
Of course it does. That's what the codex <> chat merge is actually doing.
But codex <> chat merge is what they're giving as the "real reason" for what actually is raising prices (a LOT, I might add) for all the subscriptions. Nobody wants it (certainly not applied globally to everything like it is), but they're still going to do it. I even know someone who works at OpenAI and there's apparently a few people trying to fight it at least internally.
Given Sam Altman's speech about how he wants OpenAI pricing to work, I don't think this can be stopped. Btw: that is that you type something into ChatGPT and instead of subscription or per-token cost or anything like that, as soon as you type something in, anything, the way he sees it, ChatGPT would give you a cost for that specific answer and you'd agree or not.
I just feel like this guy is an even worse example of not seeing the viewpoint of a normal (you know non-millionaire) person than even Google's leadership. Can I just say "I think Google is going to win from Altman", you know, despite OpenAI having the far superior technology. Because if there's one guy in the whole world that can destroy the advantages of OpenAI's engineering accomplishments for everyone else, it's this guy ...