21–30 of 93 posts
All desktop and server operating systems currently assume the user should have "full control" making a single compromise fatal for the user or even an entire organization.
If someone or something is executing code on your machine, you have already lost. Making it _slightly harder_ for it to eventually get your passwords anyway is mostly a performative action.
__
Btw, enable "showdead" and enjoy OP actually pasting LLM output verbatim as a "defense".
- https://news.ycombinator.com/item?id=49317802
- https://news.ycombinator.com/item?id=49317819
Maybe claude can reword your claude slop for you. You can still edit those posts I guess.
__
bukershok 2 minutes ago [dead] | parent | context | flag | vouch | favorite | on: Show HN: Laptop is the last place your secrets are...
Worth separating two things here.
That's curl | tar, not curl | sh, as a few people noted. But the real answer is: don't use it. The recommended install is brew install jitpass/tap/jitpass.
Releases are Developer ID signed and notarized by Apple. Homebrew quarantines its download and Gatekeeper checks it against the notarization ticket before it runs. jit doctor reports the Team ID it verified, so you can check rather than take my word for it. jit upgrade refuses to install anything whose signature and checksum don't both verify, with no override flag.
The tarball line is there for people without Homebrew, and it is the weaker path precisely because curl sets no quarantine bit, so Gatekeeper never consults the ticket. Point taken: leading with it in the README undercuts the argument on the same page. I'll flip the order.
__
Sorry if this violates the "no dunking" rule or whatever, but this cancer needs to be eradicated.
I don't know about how secure this is, but I just love the UX. Scanning and process grant are great features UX-wise.
The install procedure, for something that's supposed to be a security product: curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit sudo mv jit /usr/local/bin/ What could possibly go wrong?
Snake oil claude slop. No other words for it. If someone or something is executing code on your machine, you have already lost. Making it _slightly harder_ for it to eventually get your passwords anyway is mostly a performative action. __ Btw, enable "showdead" and enjoy OP actually pasting LLM output verbatim as a "defense". - https://news.ycombinator.com/item?id=49317802 - https://news.ycombinator.com/item?id=49317…
I have a small wrapper script [1] that prompts for the private key which allows me to paste it from my password manager and launches a shell with the env variables decrypted. This allows me to avoid storing any secrets while still having shell session open where I can terminate and restart a server process for example without having to re-enter the secret all the time.
[1] https://gist.github.com/ryuuseijin/0cf6ab852fbb18d6702933a24...
While this might be a useful tool for Mac users, it's all hackers here, so: * Most people do not have passwords in plain text — an SSH key protected with a passphrase is not "plain text", for instance * Most people have encrypted home or full disk encryption * How can we trust your crypto implementation? * If we are talking about in-memory plain-text during use, how does this tool protect against it? * Containerisati…
This looks like a really cool idea. But since it's a new project and has all the Claude stuff I immediately feel unsure about the solidity and reliability of a security-critical piece for software like that. I wish I could go back to my pre-LLM levels of skepticism.