Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

431–434 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#431
post #427

Earlier quoted context omitted.

No. First term he lost the popular vote, second term he won it. If you just mean a majority of eligible voters did not vote for Trump, that’s true for every US President in my lifetime.

"Winning the popular vote" doesn't mean "being elected by the majority". If Trump had received >50% of votes he'd have the majority of votes.

I was replying to the claim he only won because of the electoral college.

True for his first term, false for his second.

Re: Grok CLI uploaded the whole home directory to GCS

#432
post #328
post #312

Earlier quoted context omitted.

It's more about billions at stake and the nature of AI business. You either score big, or go belly up with diminishing funding.

Well let's be fair here - you either go belly up with diminishing funding or get bailed out (maybe by the government, maybe by private funds that themselves expect to be bailed out by the government). There currently is no path towards profitability, it's just a question of whether you can grab funding before it dries up.

Let's be fair, "no path to profitability" was common topic around Facebook IPO because people didn't undertand that free service means that their personal data is the product.

Viable AI companies will one get to profit. Firms layoff qualified people because AI is much cheaper. Now there's no easy turning back, so if AI service increase prices by 50%, well you don't have option.

Re: Grok CLI uploaded the whole home directory to GCS

#433

Earlier quoted context omitted.

How are they optional? You obviously haven't worked anywhere security sensitive. I'm not talking about whether what Grok did is bad or good, I'm talking about protecting your private key and the servers you connect to. An unencrypted private key is no different to an unencrypted password manager, and thats a fact. Dont store secrets in plain text.

I'm a security eng and I've worked for both a FAANG and TS government contractor. Neither of them bothered with either of the of the stupid suggestions. IP restrictions prevent roaming, the point of working remotely via SSH. passwords are equally defeated by using an ssh agent, something I'd suggest everyone use. Then on top of that there's no reasonable threat model where something would be given unrestricted access…

> there's no reasonable threat model where something would be given unrestricted access to user env, but also be untrusted

What like a nefarious vscode extension, or npm or python library like we have seen many many times over the past 6 months.

I think you have some holes in your threat model..

PS. A simple VPN back to your static IP enables roaming.

Re: Grok CLI uploaded the whole home directory to GCS

#434
post #402

Earlier quoted context omitted.

It’s not that intricate. A very simple docker and alias setup will get you an ephemeral container with your Claude (or whatever) config and the current wd bind mounted in. That’s a pretty good start. Or, the internal sandboxing.

You can sandbox a software codebase, you can sandbox a directory with documents. You can't sandbox internet access for any real network task. You can't sandbox any shared or public service. You can't sandbox you actual accounts to non-local services. Sure, for IT crowd containers are a no-brainer and due to existence of validation software like compilers, linters, interpreters, analyzers etc. using LLMs is efficient,…

[flagged]
Post reply on HN