Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex Security

github.com

Post reply on HN
Print view View original

91–100 of 257 posts

Re: Codex Security

#91

Post by alasano »

dangelosaurus wrote: post #60
gregwebs wrote: post #41

Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: R…

Oof, that's a bad outcome. Half your weekly usage and a 50-minute scan just to get a HEAD error at the end is not acceptable. --max-cost can help limit estimated spend, but that doesn't fix the underlying problem or give you your quota back. We need to handle a changing checkout and partial results much better. Sorry you ran into this. Please send me an email.

Damn. Just ran it and it used 5 years worth of Pro usage in 5 minutes.

If ya wouldn't mind crediting me a quick 60 months that would be great.

Re: Codex Security

#92

Post by ipnon »

schrodinger wrote: post #90

Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…

Yes, now that humans write less than 99% of code, the most important criteria for a language isn't readability, which I'd argue was always Python's main selling point, but the underlying runtime. There are practical limits to how fast a Python program can run either under I/O or CPU bound compared to other popular and mature languages with extensive libraries, like Elixir, Go or C++, depending on your use case.

Re: Codex Security

#93

Post by typpo »

teaearlgraycold wrote: post #49
gregwebs wrote: post #41

Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: R…

I plan to hack it to use openrouter and Kimi K3 or GLM 5.2 to keep expenses reasonable. For context can you share the line count?

No need to hack it, we'll add proper support for this.

Re: Codex Security

#94

Post by tripleee »

ipnon wrote: post #92
schrodinger wrote: post #90

Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…

Yes, now that humans write less than 99% of code, the most important criteria for a language isn't readability, which I'd argue was always Python's main selling point, but the underlying runtime. There are practical limits to how fast a Python program can run either under I/O or CPU bound compared to other popular and mature languages with extensive libraries, like Elixir, Go or C++, depending on your use case.

> now that humans write less than 99% of code, the most important criteria for a language isn't readability

please tell me you're reading the AI code

Re: Codex Security

#96

Post by hellohello2 »

gregwebs wrote: post #41

Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: R…

Pro is 10$ a month. You get what you pay for lol.

Re: Codex Security

#97

Post by computerex »

schrodinger wrote: post #90

Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…

I think it's because python is far more approachable/ubiquitous than go/rust. It's the entry level language for many people from all disciplines of life. Scientific community uses it, data science uses it.

Golang/rust however are very convenient to distribute. Small, portable, fast exe's are very nice. With agentic coding golang/rust are now accessible to a lot more people.

Re: Codex Security

#98

Post by computerex »

tripleee wrote: post #94
ipnon wrote: post #92

Earlier quoted context omitted.

Yes, now that humans write less than 99% of code, the most important criteria for a language isn't readability, which I'd argue was always Python's main selling point, but the underlying runtime. There are practical limits to how fast a Python program can run either under I/O or CPU bound compared to other popular and mature languages with extensive libraries, like Elixir, Go or C++, depending on your use case.

> now that humans write less than 99% of code, the most important criteria for a language isn't readability please tell me you're reading the AI code

Not really. I test the output thoroughly, I examine the thinking process, I go through the diff to see if anything jumps out but I my thinking process/the way I work has changed. Low level programming thinking has gotten atrophied it seems.

Re: Codex Security

#99

Post by solid_fuel »

jameshart wrote: post #63
orangelimesoda wrote: post #56

Earlier quoted context omitted.

> Have experience shipping production full-stack products across modern web frontends and backend services. I'm amazed that the requirements are so low (or at least this vague) for jobs at companies like these. Has anyone else had the experience of going to an interview and feeling like you were never asked any qualifying questions? All the questions were easy, your answers were straightforward, you "got them right",…

This sounds like it’s just an app development role, not a security analysis position, so I’m not sure what your complaint is.

Professional app development requires an understanding of security.

Re: Codex Security

#100

Post by akomtu »

oursland wrote: post #68
luciana1u wrote: post #24

security tools from AI companies feel like fire departments run by arsonists. useful, sure, but you can't help noticing who benefits from all the fires

They're only discovering the security flaws that exist. Would you rather them not be exposed and corrected? To "Slow the testing down"?

I think his point is that AI is really good at finding vulnerabilities.
Post reply on HN