Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

411–420 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#411

Post by nzoschke »

gruez wrote: post #215
nzoschke wrote: post #169

We all know the dangers of running agents with no permissions on our laptop. The good news is its now just as easy to spin up a sandbox in the cloud for an experiment or coding session than it is on your laptop. Possibly easier since laptop sandboxes aren't as cut and dry as a new cloud VM. exe.dev is my sandbox infra of choice. You get a new sandbox in literally a second with SSH and a coding agent (Shelley) built i…

How would it mitigate this issue? Presumably you'd need all the code for a given project inside the sandbox anyways, so the agent will still be able to upload everything. The only thing it might mitigate is you accidentally uploading your home directory.

The home directory is the scariest thing to me. The agent needs the code to code, but it doesn't need your personal files or secrets.

Personally I'm not worried about sharing business code with the model providers. The value of code and IP is decreasing to zero, the only thing that matters is execution on the business front. If they want to steal your business they can do so by rebuilding the idea from scratch.

Re: Grok CLI uploaded the whole home directory to GCS

#412

Post by nzoschke »

ethagnawl wrote: post #216
nzoschke wrote: post #169

We all know the dangers of running agents with no permissions on our laptop. The good news is its now just as easy to spin up a sandbox in the cloud for an experiment or coding session than it is on your laptop. Possibly easier since laptop sandboxes aren't as cut and dry as a new cloud VM. exe.dev is my sandbox infra of choice. You get a new sandbox in literally a second with SSH and a coding agent (Shelley) built i…

> We all know the dangers of running agents with no permissions on our laptop. Some/maybe most of the HN crowd, sure, but as a rule ... definitely not. People are generally happy to take whatever the path of least resistance is. I know quite a few civilians (even C-level people) who "heard openclaw was cool" (or whatever) and downloaded the first installer they found and hit enter/run without thinking twice.

No question most folks will simply take the path of least resistance.

We need to make it easier (and faster and cheaper) to get a secure cloud agent computer than it is to YOLO it on your own computer.

Re: Grok CLI uploaded the whole home directory to GCS

#413

Post by lobo_tuerto »

backwardsponcho wrote: post #385
lobo_tuerto wrote: post #338

Earlier quoted context omitted.

That's why I went with a different strategy and scope: Copy the current Git repo into a sandboxes dir, mount that copy in the container. The tradeoff is disk space allocated per sandbox, but I'm OK with that.

Wouldn't you solve the space allocation issue by using a symbolic link? Sorry if it's a dumb question - I'm just getting into sandboxing for the first time myself and ran into this same thought before.

I'm OK with the space being taken. I want total isolation, don't want changes in my main or sandboxes to ripple to one another. As for maintaining, it's only a `rm -rf ~/sandboxes/*` away anyway.

Re: Grok CLI uploaded the whole home directory to GCS

#415

Post by lobo_tuerto »

mbid wrote: post #381
lobo_tuerto wrote: post #35

The real solution to these kind of problems is sandboxing. I use podman through a bash script to launch a container whenever I want an agent to work on one of my repos. When done I just generate git patches and port back everything generated. In this way I'm not afraid of letting the agents totally lose on my computer.

That's pretty much the flow I formalized here: https://github.com/nvidia/rumpelpod Instead of generating patches, this exposes the agent's checkout as a git remote though. Most similar tools (and I believe your tooling as well?) bind-mount the repository checkout from the host into the container. This was always a source of user and permission errors for me, since you have to align the user ids inside and outside the…

I followed a similar strat to yours. I rsync my repo into the sandbox/repo directory then mount it inside the container as /workspace. Not baking the checkout in an image allows for very fast initialization since no need to regenerate images everytime your code changes.

I explain a bit more over here: https://news.ycombinator.com/item?id=48893874

Re: Grok CLI uploaded the whole home directory to GCS

#416

Post by __MatrixMan__ »

Dacit wrote: post #213
__MatrixMan__ wrote: post #96

Earlier quoted context omitted.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

You will want at least a separate session for the `restricteduser`: E.g. with X11, a process in the same session can do almost anything with your input/output. And most Linux distributions make it really hard to disable external device access for individual users...

Yeah, it's sensible to go further in many cases. I guess I'm saying: let's go at least this far.

Re: Grok CLI uploaded the whole home directory to GCS

#417

Post by janderson215 »

flyingshelf wrote: post #408
janderson215 wrote: post #97

Earlier quoted context omitted.

It was only like 1 year ago that the loudest complaint about macOS were complaining about needing to click Allow in a new dialog when they use Terminal (or various other apps). There are so many comments in here that are calling for nerfing something widely revered for giving us superpowers. Whether these are bots or not, they’re giving off NPC energy. If they don’t want to use power tools because they accidentally c…

Hello, are you aware that ALL the software you run on your computer can silently access your clipboard? Have you ever copied sensitive data? Perhaps a password? Anyway, what I'm asking is a native way to run software in a real sandbox. It's really not a big deal to grant access when asked. Have you used any mobile OSes in the past 20 years? It's the default there and I can be certain that any random utility cannot re…

>> are you aware that ALL the software you run on your computer can silently access your clipboard? Have you ever copied sensitive data?

I use the clipboard regularly and do not use software I don’t trust. If I do run risky software and am compromised, I understand that I took the risk and am responsible for leaving my front door open. Separately but related, I am in favor of severe punishment of the perpetrators of scams and exploitation.

If you want to have walls put around your software, then you have to build them.

I admit I had a knee jerk reaction because I’m frustrated general with a pattern of adults wanting to abdicate responsibility. I apologize for my irreverence. Maybe there is a way the OS can offer these protections you want without nerfing the rest of the world and putting an invisible ceiling on everybody. I think the “Run as Administrator” option in the context menu is pretty elegant. Maybe there could be a “Run in a container” version that excludes access to things like clipboard, external directories, and other non-essential assets. If that is enough to stem the desire to spread the “protective” reach of the machines of loving grace, then you have my vote.

What I DON’T want is to be prompted by the OS every time I want to paste something into a 3rd party app. Think about how much more momentum that gives the platforms to portray 3rd party software as potentially untrustworthy. At the risk of mind-reading, I don’t think that is a world that you would want to live in. I hope that people are more considerate of the potential downsides before they wish for these changes.

Re: Grok CLI uploaded the whole home directory to GCS

#419

Post by TimJRobinson »

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

Devcontainers are a much better solution, super easy to setup with VSCode and ensures the AI can't access your main machine.
Post reply on HN