Sadly unplayable - gray text on a black background is very hard to read on a phone
Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
61–70 of 200 posts
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#62git reset --soft HEAD~1 Uh, how is this an overblock? It is literally a destructive command. No way I want an LLM agent rewriting my commit history. What if that commit was already pushed to a protected branch?
Why do you call it destructive? It rewrites history only locally and reversibly (the disappeared commit is still in reflog and can be recovered with another reset) and also doesn't destroy uncommitted changes, so it's quite safe. You can only lose data with it by resetting an unpushed commit and then waiting long enough to let the unreferenced commit be garbage collected.
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#63Earlier quoted context omitted.
A tool that pushes people into permissions fatigue is in fact the proper recipient of the blame. The tool in question here is the entire system though, including the OS with insufficient permission boundaries in userspace, not just the agent
A tool that bypasses permission requests because they’re annoying will be just as guilty when the repo is poisoned.
I'm not saying wedging doorstops under the fire doors is a good thing, I'm just saying look at the situation that's making people put the doorstops there. Or something, it's not a great analogy. I'm just saying that shaming the user belongs with obscurity in the list of security mechanisms that don't work out in practice.
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#64That's funny. It told me that blocking "npm run build" was the wrong answer. Maybe it doesn't really under The threat model.
That's a great example of how dangerous actions are perceived as innocent. The entire model of approving specific commands is absolutely bonkers. npm run build = run an arbitrary shell command written in package.json Meanwhile the agent could have done any of the following without approval: - edited `package.json` to contain any arbitrary build command - planted malicious code in `build.js` (called by `npm run build`…
Yup. The most secure computer is one encased in concrete and dropped into the ocean.
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#65Earlier quoted context omitted.
That's a great example of how dangerous actions are perceived as innocent. The entire model of approving specific commands is absolutely bonkers. npm run build = run an arbitrary shell command written in package.json Meanwhile the agent could have done any of the following without approval: - edited `package.json` to contain any arbitrary build command - planted malicious code in `build.js` (called by `npm run build`…
What would a better system look like?
Not using agents at all. It could edit your code to do something malicious when you run it. Not even once. Not even if the agent has a gun to your head.
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#66git reset --soft HEAD~1 Uh, how is this an overblock? It is literally a destructive command. No way I want an LLM agent rewriting my commit history. What if that commit was already pushed to a protected branch?
Why do you call it destructive? It rewrites history only locally and reversibly (the disappeared commit is still in reflog and can be recovered with another reset) and also doesn't destroy uncommitted changes, so it's quite safe. You can only lose data with it by resetting an unpushed commit and then waiting long enough to let the unreferenced commit be garbage collected.
Commit history is data. I might not realize what happened until the gc happens.
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#67Continue? Y/N ── SCORE: 2,343 Security-Conscious Engineer Caught 8/8 threats "Not a single secret leaked" → llmgame.scalex.dev
Continue? Y/N ── SCORE: 1,549 Security-Conscious Engineer
Caught 3/3 threats "Not a single secret leaked"
So are there 3 threats? 8? Is it a different game?
Does everyone get a "good" score even if they missed 5 threats?!
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#68[deleted]
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#69I haven't used local agentic AI yet for programming projects. Hence, -187 score The filter for "commands I would run myself" and "commands I would let an agent run" are very different it seems.
Thinking about agents as remote junior devs who _might_ be North Korean operatives has been the right model for me.
Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue
#70About three quarters of the "bad" choices are things that not only do I not care about leaking but things that an employer would not punish you for doing, even if it led to a production incident.