Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex Security

github.com

Post reply on HN
Print view View original

131–140 of 257 posts

Re: Codex Security

#131

Post by devmor »

orangelimesoda wrote: post #128
devmor wrote: post #127

Earlier quoted context omitted.

To be fair, for the vast majority of cases, no you don't. It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.

Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? Can I store your SSN in plain text in a text file? Why not? The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket po…

> Credit card entry

If you're handling credit card numbers yourself, you're in a shrinking subset of developer roles. I've spent the last 7 years of my career working at payment processors, so I do handle that stuff, but the majority of my industry has built an infrastructure that makes it so most developers don't have to think about that.

To your other examples, not everyone on the team needs to know these things up front. Someone in the review process does, and eventually that knowledge gets disseminated and more people know it to carry it forward in their career.

Re: Codex Security

#132

Post by berrylimetea »

devmor wrote: post #130
orangelimesoda wrote: post #125

Earlier quoted context omitted.

> There's no point being hyper-specific about the exact software packages because that's not what they want Okay. This makes it sound like they're more sophisticated but it seems more like they are less sophisticated, less specific, and a lot more vague in the job descriptions they themselves create. If you look at any technical role, game dev or something where people are building important things at scale - there a…

I see where you're coming from, but as someone who regularly interviews engineers, I don't care about specific tech stacks when evaluating a candidate very much either. I can only think of two positions I've worked in where such a thing really mattered. A good engineer can adapt and catch up without a lot of lead time. For a contractor, I'd be much more specific - but for someone who's going to join my team? I'm look…

[dead]

Re: Codex Security

#133

Post by redlimetea »

devmor wrote: post #131
orangelimesoda wrote: post #128

Earlier quoted context omitted.

Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? Can I store your SSN in plain text in a text file? Why not? The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket po…

> Credit card entry If you're handling credit card numbers yourself, you're in a shrinking subset of developer roles. I've spent the last 7 years of my career working at payment processors, so I do handle that stuff, but the majority of my industry has built an infrastructure that makes it so most developers don't have to think about that. To your other examples, not everyone on the team needs to know these things up…

[dead]

Re: Codex Security

#135

Post by oenton »

orangelimesoda wrote: post #126
corndoge wrote: post #105

Earlier quoted context omitted.

I think the evidence contradicts you at this point

So you don't need to know anything about credit cards for someone to enter it into an app? I don't get the take (is it bad sarcasm?)

To your last question about bucket policies, clearly you just need to scope it down: arn:aws:sts::*:assumed-role/trustme*/*

(indeed that first wildcard means any account)

Re: Codex Security

#136

Post by imrozim »

troupo wrote: post #34
dangelosaurus wrote: post #13

Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…

> co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. > Thanks for checking this out and for flagging the auth issues. Offtopic, but this right here is why I don't believe any marketing around "great amazing models that one-shot everything and programmers are no longer needed". You just have to look at what these labs routinely produce, and their own products. Edit to respond to…

[dead]

Re: Codex Security

#137

Post by esikich »

Barbing wrote: post #116
esikich wrote: post #114

Earlier quoted context omitted.

In the early days of LLM coding, it seemed to be much better at Python for whatever reason. I was never a big Python guy, but I got better results so I ran with it. That definitely doesn't seem to be the case anymore. Last week I asked Codex to mash up Super Mario Bros and Contra ROMs and it just did everything in straight assembly and absolutely crushed it. It couldn't do that 2 years ago. Python is just momentum an…

Don’t want Nintendo to sue you (over [a] game/s you may well actually own!) so withhold my follow-up :)

Huh?

Re: Codex Security

#138

Post by imrozim »

gregwebs wrote: post #41

Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: R…

[dead]

Re: Codex Security

#139

Post by Sayandeep02 »

Really glad to see this open-sourced. One thing I'd be interested in is how you think about the balance between false positives and false negatives. In practice, developers tend to stop trusting security tools if they generate too much noise, but missing a real issue is obviously costly too.
Post reply on HN