Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex Security

github.com

Post reply on HN
Print view View original

171–180 of 257 posts

Re: Codex Security

#171

Post by maxloh »

ryanto wrote: post #145

Hey looks cool. I tried to run this on a small oss library and here's what happened: $ codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:01] Preparing scan [00:42] Running scan [00:42] Preflight: worker delegation supported (up to 8 worker slots). [41:03] Running scan codex-security: This content was flagged for possible cybersecurity risk. If this seems wrong, try rep…

IMHO, tokens should be refunded if the agent refuses to work. Charging users for a session that produced no final output is ridiculous.

Re: Codex Security

#172

Post by sudo_cowsay »

dangelosaurus wrote: post #13

Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…

Hi! Any remote internship for a high schooler? lol

Re: Codex Security

#173

Post by LtWorf »

krater23 wrote: post #51
bakigul wrote: post #20

Earlier quoted context omitted.

Why would a few code snippets put Snyk out of business?

I don't understand why Snyk is IN business in any way. Who really wants to upload his own code to a company that is specialized at searching security issues? How can I trust that they show me all findings they have instead of selling the best ones to some three letter organisations?

One of their sales people made fun of me via email. Apparently they believe that not being their customers means you cannot possibly know if a dependency you use has an active CVE.

Also they haven't figured out codeberg exists, so the resume page of a project of mine on snyk[1] still links to github and reports the project as "inactive", having the last commit 2 years ago, and the last release 2 months ago. I think it's quite telling of their quality.

1. https://security.snyk.io/package/pip/typedload

Re: Codex Security

#175

Post by renezander030 »

Sayandeep02 wrote: post #139

Really glad to see this open-sourced. One thing I'd be interested in is how you think about the balance between false positives and false negatives. In practice, developers tend to stop trusting security tools if they generate too much noise, but missing a real issue is obviously costly too.

[flagged]

Re: Codex Security

#177

Post by tick_tock_tick »

cedws wrote: post #106
schrodinger wrote: post #90

Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…

Is that so? I feel like I’m seeing more Python and TypeScript than ever, especially when it comes to AI tooling, which is disappointing. I can’t fathom why anybody would want to continue working with dynamically typed languages when they can now get types for free.

Almost all my tool/skill scripts are in python purely because the standard library has almost everything under the sun in it.

Re: Codex Security

#179

Post by andreagrandi »

Folks, are you SERIOUS?!

codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:01] Preparing scan [31:25] Running scan codex-security: This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

I mean... wasn't this the intended goal? And you wasted all my tokens for nothing?!

Re: Codex Security

#180

Post by petesergeant »

customguy wrote: post #119
orangelimesoda wrote: post #56

Earlier quoted context omitted.

> Have experience shipping production full-stack products across modern web frontends and backend services. I'm amazed that the requirements are so low (or at least this vague) for jobs at companies like these. Has anyone else had the experience of going to an interview and feeling like you were never asked any qualifying questions? All the questions were easy, your answers were straightforward, you "got them right",…

Not having clear, objective criteria enables arbitrary decisions (not against OP, I mean in general.. and in general I dislike this pattern a lot). On the extreme other end of the spectrum would be 100% objective criteria, and companies being forced to pick a random applicant that matches them. If they want only the best, they have to have high expectations, but be able to actually define them. You say "cultural fit"…

All fair points and I guess I would dislike it more if it hadn’t benefitted me more. In general, if I can get face-to-face with a human then I have a huge advantage, and any barriers to getting to that point are a net negative to me.

At the start of my career I was under-credentialed, and had to rely on lax requirements to get myself in front of people. I might never have gotten anywhere if my first few employers hadn’t been willing to overlook a lack of degree or commercial (rather than open-source) experience, directly as a result of a funnel with a wide entrance.

Post reply on HN