231–240 of 317 posts
Earlier quoted context omitted.
Most programmers and power users install large dependency trees with npm/pip/bundler/... on the same user account as their main browser on a regular basis. Even on Linux where it's easy to create new user accounts. This isn't much different.
Two bads doesn't give you one good.
Stockholm syndrome
Earlier quoted context omitted.
And when you want to share some but not all files with that one user but not other users you created for similar purposes? And when you want the outputs of that user back to your main user? And when you want that user to access some shared credentials for external services, but not all? It’s not the account setup that’s hard, it’s the workflow of spreading a single real-world across multiple accounts.
All of those use cases are very easy to facilitate using filesystem permissions and groups.
Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.
I kid, somewhat.
I do think it's good to remember, "running things on your system with full admin rights" goes all the way back to monopoly-era Microsoft where it was never meaningfully addressed, and we're just still living downstream of that.
Earlier quoted context omitted.
Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data…
but this seems quite overkill no? I currently run pi agent in Lima on a Mac with only the code project folder mounted and an extension that prevents pi agent from reading the contents of .env files directly. Yeah, there probably are some freak situations where this isn't safe enough, but I don't really see any realistic ways this is going to end up badly. Am I overlooking some obvious security holes?
It eliminates the manual process steps you end up doing with an ad-hoc system (which gets old the 10th time you do it).
Common weak points:
- The agent can access your homedir.
- The agent can access .gitignored files, which can contain secrets (and are gitignored for this reason).
- The agent has r/w access to your workdir.
- The agent could follow your remote mounted dirs.
- The agent can act in your name with whatever credentials it finds (and it will use them when it tries to be helpful, especially with the gh tool).
- Do you even know what's in the diagnose_problem.sh file it just created and asked permission to run?
- Even the .git dir can be weaponized, such as with evil filters.
- The agent can edit its own process, bypassing the harness controls and giving it the same access as you have (amplified by each credential sitting on that machine).
Meanwhile, you're reflex-hitting ENTER without looking because 99% of the permission prompts are mundane.
And that's before you even get to all of the idiosyncrasies in the backends that will eventually trip you up. The list is quite large and continually growing: https://github.com/kstenerud/yoloai/blob/main/docs/contribut...
Earlier quoted context omitted.
And when you want to share some but not all files with that one user but not other users you created for similar purposes? And when you want the outputs of that user back to your main user? And when you want that user to access some shared credentials for external services, but not all? It’s not the account setup that’s hard, it’s the workflow of spreading a single real-world across multiple accounts.
That’s what user groups are for.
Earlier quoted context omitted.
sudo useradd -m [username] ? su [username] ? Or am I understanding your idea about switching context wrong?
This doesn't really when the CLI tool needs to access any data in your /home. There isn't a straightforward way using standard POSIX tools to share a directory with another user. (Of course it's possible , but it's not easy.)
Your private SSH keys? Your browser’s cookie jar? Your tax reports?
Earlier quoted context omitted.
That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl. To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.) There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I devel…
Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data…
Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.
Most programmers and power users install large dependency trees with npm/pip/bundler/... on the same user account as their main browser on a regular basis. Even on Linux where it's easy to create new user accounts. This isn't much different.
The dependency trees have a whole system that's evolved for decades. The same code goes into many computers. Many people read the source, security firms look for vulnerabilities, etc.
Language models are a completely new paradigm. The code it writes on your machine is the only instance of that code. It does far more than anybody could ever keep track of.
It's much harder to detect problems, and nobody to hold accountable for them.