Install.md: A standard for LLM-executable installation
121–124 of 124 posts
Re: Install.md: A standard for LLM-executable installation
#122Earlier quoted context omitted.
I think my preferred version of this would be a hybrid. Keep the regular installer, add a file filled with information that an LLM can use to assist a human if the install script fails for some reason. If the installer was going to succeed in a particular environment anyway, you definitely want to use that instead of an LLM that might sporadically fail for no good reason in that same environment. If the installer fai…
Acknowledged. The standard includes a link to the llms.txt for a site at the bottom which is intended to give it that "knowledge base" to query. I think I agree with you on it needing to assist in event of failure instead of jumping straight to install though. Will think more about that.
Re: Install.md: A standard for LLM-executable installation
#123But I DON'T think the standard should start by piping the prompt directly into claude/model cli. I say this as someone who has seen, first hand, an exfiltration attack locally and almost fell for it after 20 years as a developer.
Even if initially the install.md is safe, install prompt scripts and the things they download aren't packaged and static. They're all surfaces to exploit. The sub-components can be changed between any install, this is true unless we image versions and cache the "safe" imaged version and approve it.
What would be safer to me is a hub that you give a single install script that creates "images", .e.g. DMG for a Mac, .exe for Windows, etc., for platforms. That may actually be an installer app that the User or Agent opens then finishes locally for configuration. Then you point your Agent to that hub.
Nevertheless, then I would just recall XKCD and say, why not just package it with NPM, PyPi, brew, etc.
Re: Install.md: A standard for LLM-executable installation
#124Writing a truly comprehensive install.sh script is comparatively inane, for starters, you immediately take out windows compatibility.
As expected, engineers (inc me.) will be reluctant to add non determinism to a solution that doesn't need it. Having deeper thinking traces/ logit debugging could help alleviate the concern.