[deleted]
Codex Security
151–160 of 257 posts
Re: Codex Security
#152Earlier quoted context omitted.
Thanks! You've run into a real limitation: the CLI doesn't bypass the model's cybersecurity guardrails. If GPT-5.6 Sol finds a vulnerability but refuses to explain it, switching from the Codex app to the CLI won't automatically fix that. For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals depending on the model and the account or organization where access is provisioned. It isn…
>> For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals Or perhaps a better option is to use something like Kimi K3 and cancel the GPT subscription altogether.
Or try Grok, 4.5 seems pretty capable, should be close to K3 in many coding tasks. I use it for code review of what other "stronger" models shit out (like Sol) and it constantly finds even pretty big bugs or just not robust enough solutions (Sol tends to overengineer, yes, but I'm not so sure it overengineers the right parts, so far my experience woth it has been mid. Except it understanding my drawings and collages and it being capable of far better frontend/design dev than 5.4 or even 5.5 was).
Re: Codex Security
#153It seems cool.
Re: Codex Security
#154Earlier quoted context omitted.
Professional app development requires an understanding of security.
I think the evidence contradicts you at this point
That's quite an indictment of the common app development practices. (Not that I disagree with your point...)
And security is hard. Because it is by definition off the happy path, it is quite often at odds with MVPs and rapid release cycles. Then you add all the ways the users can use your product to attack/abuse others.
Any non-hobbyist app development does indeed require at least a decent understanding of security.
Re: Codex Security
#155[dead]
Re: Codex Security
#156Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…
> As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particular strength of Python.
That sounds exactly like a strength of Python, no? Python is excellent at working IO blocks and waiting in general being interpreted language with first-class async support.
Re: Codex Security
#157Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…
> Have experience shipping production full-stack products across modern web frontends and backend services. I'm amazed that the requirements are so low (or at least this vague) for jobs at companies like these. Has anyone else had the experience of going to an interview and feeling like you were never asked any qualifying questions? All the questions were easy, your answers were straightforward, you "got them right",…
It depends whether your goal is to hire for specific knowledge (hence specific questions) or for overall mindset and abilities (hence broader questions where you are able to extract the way a person thinks)
Re: Codex Security
#158Earlier quoted context omitted.
A license and presumably revshare is required for large scale inference as a service of Kimi K3. There's clearly something going on right now with every router at the same or higher price as the Moonshot list price. So I wouldn't count on competition if $/mil token is actually set by Moonshot, but I would expect $/tok to drop when there's a more competitive frontier open weight model.
Where did you get that from? That‘s not what the license says: https://huggingface.co/moonshotai/Kimi-K3/blob/main/LICENSE The current price is likely a result of the high demand and the high requirements of this model.
Did you actually read the license?
> If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose.
Re: Codex Security
#159Earlier quoted context omitted.
Don’t want Nintendo to sue you (over [a] game/s you may well actually own!) so withhold my follow-up :)
Huh?
> I asked Codex to mash up Super Mario Bros and Contra ROMs
Did this create a new game? And did you publish the result? Might’ve misunderstood.
Re: Codex Security
#160Hey looks cool. I tried to run this on a small oss library and here's what happened: $ codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:01] Preparing scan [00:42] Running scan [00:42] Preflight: worker delegation supported (up to 8 worker slots). [41:03] Running scan codex-security: This content was flagged for possible cybersecurity risk. If this seems wrong, try rep…
Same thing happened to me. The partial output did contain some useful signal but I was disappointed to see it didn’t finish.