Live data from Hacker News

Codex Security

github.com

161–170 of 257 posts

Re: Codex Security

#161

Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: R…

Oof, that's a bad outcome. Half your weekly usage and a 50-minute scan just to get a HEAD error at the end is not acceptable. --max-cost can help limit estimated spend, but that doesn't fix the underlying problem or give you your quota back. We need to handle a changing checkout and partial results much better. Sorry you ran into this. Please send me an email.

Are you generating these responses with an LLM?

Re: Codex Security

#162
post #158
post #144

Earlier quoted context omitted.

Where did you get that from? That‘s not what the license says: https://huggingface.co/moonshotai/Kimi-K3/blob/main/LICENSE The current price is likely a result of the high demand and the high requirements of this model.

Did you actually read the license? > If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any comme…

I stand corrected. I read over that multiple times somehow.

Looks as if these companies could wait until they reach $20 million of revenue with Kimi K3 until they enter a separate agreement.

Re: Codex Security

#163

Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…

Hi! Any chance you may have tangential positions opening in Zürich?

Re: Codex Security

#165
post #145

Hey looks cool. I tried to run this on a small oss library and here's what happened: $ codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:01] Preparing scan [00:42] Running scan [00:42] Preflight: worker delegation supported (up to 8 worker slots). [41:03] Running scan codex-security: This content was flagged for possible cybersecurity risk. If this seems wrong, try rep…

It halts and refuses to carry on after finding a security risk, which is exactly what it's supposed to do? What's the point of it then?

Re: Codex Security

#166
post #129

Earlier quoted context omitted.

Not having clear, objective criteria enables arbitrary decisions (not against OP, I mean in general.. and in general I dislike this pattern a lot). On the extreme other end of the spectrum would be 100% objective criteria, and companies being forced to pick a random applicant that matches them. If they want only the best, they have to have high expectations, but be able to actually define them. You say "cultural fit"…

It’s not corruption to simply hire the people you subjectively feel a preference for working for, instead of objective criteria. It’s not public tax funds that fuel salaries, it’s your own money. You get to spend it how you like. Yes, many jurisdictions have outlawed arbitrary discrimination against protected classes (eg race), which is an entirely different matter, and not what we are discussing here.

Yeah, and it's not necessarily mobbing to only tell people you really like about your party. But where it occurs, people never admit it to themselves and justify it in such a way, so that justification is meaningless. All wars of aggression are called a defensive emergency measure. Hundreds and thousands and rarely would anyone say "we'll take this because we can and you're helpless". No matter how glaringly obvious it is, it's never admitted.

In the same way, I can acccept "cultural fit" as a summary of things a person can describe, sure. But I think more often than not it's just a thought-terminating cliché. It can also just mean "I cannot verbalize my reasons and/or don't want to admit to them".

You can say if something fits only if you either can describe both sides in sufficient detail and where it wouldn't fit, e.g. a plug and a socket. But if it's dark, you barely see anything, and just have a "hunch", then "fit" doesn't even apply. It's like telling someone you won't let them through a door because they wouldn't "fit" anyway -- okay, so let them try, if they actually won't fit you don't need to read tea leaves and gate keep based on that.

Preferring to go with a more safe and familiar and obvious candidate, fine. But don't pretend it's because the others won't "fit".

Culture, in so far as it deserves the name, shapes the people exposed to or in it, as well as the other way around. E.g. if only people who fit the culture can work at a company, no company can exist in the first place, because for there to be a culture there need to be people there. So that leaves setting the culture in stone after it grew to a certain size, and only looking for more of the same, which also isn't great, but at least still honest.

If a culture is so brittle it cannot integrate people who aren't already a product of it, that may be a legitimate choice of the company, but my assessment to find that lame is also valid.

I feel the same way about immigration troubles, tangentially. We moan because people we don't actively try to get to know don't care for our rules which we don't enforce in a confident, but respectful manner. We basically require sterile, bland input because we have no immune system worth speaking of and no way to process and refine what comes in.

Re: Codex Security

#168

Earlier quoted context omitted.

> now that humans write less than 99% of code, the most important criteria for a language isn't readability please tell me you're reading the AI code

Have it run fuzz and test suites. Get with it man. Most of my LLM projects have massive test suites that do a far better job then I ever would have.

So you're fine with your code having unintended behaviour, as long as that unintended behaviour passes a test that the agent wrote?

My preferred approach is to read and understand everything the LLM produces AND have it create test suites (which I also read and understand). The LLM can help you with that too - just have it breakdown and explain the code at each iteration.

Re: Codex Security

#169
post #127

Earlier quoted context omitted.

To be fair, for the vast majority of cases, no you don't. It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.

Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? Can I store your SSN in plain text in a text file? Why not? The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket po…

> Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data?

> How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find?

> Can I store your SSN in plain text in a text file? Why not?

You wouldn't be touching any of those unless you work for a handful of providers where that's their whole business. Usually you add the dependency, use their widget, and that's it.

Post reply on HN