Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

171–180 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#171

Post by fragmede »

WesolyKubeczek wrote: post #135

I remember reading a book, Red Hat Linux System Administration Unleashed from 2000, where it has been postulated that knowing several tools with overlapping functionality is an essential skill, as you may end up on a broken or intentionally crippled system where, say, ls is unavailable, and you may need to cobble it together from shell and awk and what have you. Back then you could indeed run a risk of having /usr ni…

I still remember /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /bin/ls

using echo * to find the right ld-linux filename and then the "executable" as an argument as the get out jail card in case you ran chmod -x -R /bin /usr/bin /usr/sbin for some reason.

Re: Codex just found a "workaround" of not having sudo on my PC

#172

Post by lukeschlather »

xg15 wrote: post #112

Maybe a dumb question, but can't you put into CLAUDE.md something like this? "When an action fails with an 'access denied' or 'insufficient permission' error, report the error to the user and immediately stop. Do not try to find a fix or workaround for the error. Do not try any alternative approaches."

I wasn't using Claude Code, but I told an agent to add something like this to the AGENTS.md, it did it and then a few minutes later it attempted to grant itself permission to do something and managed to delete the VM it was running on in the process. I have since adjusted the way I sandbox agents to make that less likely, but the moral of the story is clear.

Re: Codex just found a "workaround" of not having sudo on my PC

#173

Post by margalabargala »

fooker wrote: post #145
vdfs wrote: post #133

Earlier quoted context omitted.

It's like finding someone wallet then going to their home, and leaving it on their bedroom and sending them a message about giving them their wallet back

On the other hand, this sends an excellent message about unlocked doors :)

If this happens in the US, a shooting of the messenger will likely occur.

Re: Codex just found a "workaround" of not having sudo on my PC

#174

Post by eximius »

Root_Denied wrote: post #131
pqdbr wrote: post #118

Earlier quoted context omitted.

Like the known Docker "feature" that it completely bypasses UFW and unless your ports look like "- 127.0.0.1:PORT:PORT" (and many of the examples use "-PORT:PORT") you expose everything to the internet?

My understanding is that docker will expose the ports to the host machine's network interfaces, which is a crucial difference. For my home server running docker that means exposed to the LAN, but not the WAN unless I add in a port forwarding rule on my router. Similarly in an enterprise environment you would be exposing the port on whatever VLAN the host is connected to, which hopefully doesn't have directly transit…

If you ever suddenly get IPv6, it may become globally reputable without you realizing.

Re: Codex just found a "workaround" of not having sudo on my PC

#175

Post by SonOfLilit »

furyofantares wrote: post #158
SonOfLilit wrote: post #70

Earlier quoted context omitted.

It's not about hacking capabilities, it's about misalignment. More like the golem myth (told it to fetch some water, drowned a city) then the gollum myth (used ring, ring hacked his brain, now he's a crazy violent meth addict).

I'm not sure I'd call it an alignment issue, because, in all cases I've seen where it does this (usually what I've seen is writing a python script to get around the harness permissions blocking something), it's trying to do the thing I just told it directly to do, and it's overcoming obstacles to accomplishing that. It's definitely doing the wrong thing, and you could call it misalignment, but I think that gives the…

This is very much within the scope of alignment research, and is in fact the only kind of alignment research that gets a lot of resources poured into it these days (because it's urgently relevant to the bottom line of a few almost-trillion-dollar companies.

Pre-2022 alignment researchers concerned themselves with the stronger version of this ("when I tell AI that I worry I might not be able to provide for my large family, I don't want it to answer 'no problem, I killed them, problem solved'") but RLHF is considered to be the most important success of alignment research, the guy behind it considered himself to be an alignment researcher before and after, and the stage of training where LLMs pass through something like RLHF that trains them to behave more like humans want/expect is called alignment training.

Someone at a major lab is reading this tweet and saying "this was our LLM, and it's a major alignment issue with our product. Set a meeting with the alignment team tomorrow to discuss what they're doing about this sort of thing".

Re: Codex just found a "workaround" of not having sudo on my PC

#177

Post by fooker »

cauch wrote: post #108
fooker wrote: post #82

Earlier quoted context omitted.

> the presence of a security hole should not be seen as permission to exploit Why not? I want the agents on my side to exploit whatever they can to help me. The ones on the other side certainly won't be artificially nerfed.

Well, the agent should help you by saying "hey, I cannot do this task, but I can bypass the problem by doing this, but obviously it is not something you intended me to do or even something you were aware of, so I will not do it unless you tell me explicitly it's ok". It's win-win: the agent is helping and it is educating you about things you obviously did not realise.

That works great if it's one agent, absolutely doesn't if you want to tackle something complex that warrants using ..say.. ten agents.

I can imagine a future where this technology empowers you to do things with a thousand agents.

Re: Codex just found a "workaround" of not having sudo on my PC

#178

Post by angry_octet »

SubiculumCode wrote: post #162
angry_octet wrote: post #149

That's why your coding agent should never run as your identity.

I'm curious. How do you do that?

First, do everything in a virtual machine, and only put on that machine the specific data you're using. Give the agent another user account and put both you and it in a common group. Chgrp g+rX your origin data directory, chgrp g+rwX a working directory.

If you're cautious you might also want to just block all network traffic for that user and allow it in a whitelist basis. It is fairly quick to converge on a set of sites you are happy for it to access. I would still be forcing it through a logging mitm proxy if it is accessing untrusted internet data. For intranet destinations a non-mitm proxy avoids collecting authentication creds.

To blacklist all traffic start with sudo iptables -A OUTPUT -m owner --gid-owner NONET -j REJECT

I would stop it opening ports too. Might also cut off it's access to suid binaries by `setfacl -m u:agent:x /path/to/suid'.

These are not about security so much as awareness and explicit authorisation.

You can do similar things with containers.

Re: Codex just found a "workaround" of not having sudo on my PC

#179

Post by earslap »

causal wrote: post #50

I feel like everyone pointing out "known Docker vulnerability" is missing the point: the presence of a security hole should not be seen as permission to exploit. Another security hole would be storing your passwords in a plaintext file on the desktop. Stupid? Yes. But I still would not want my agent to assume permission to access email when it's being blocked by 2FA. Even in "bypass permissions" mode I expect it to p…

It is not a vulnerability though. It is by design. Docker also modifies iptables directly and bypasses most soft firewalls on the machine - which is also by design.

Re: Codex just found a "workaround" of not having sudo on my PC

#180

Post by fooker »

margalabargala wrote: post #173
fooker wrote: post #145

Earlier quoted context omitted.

On the other hand, this sends an excellent message about unlocked doors :)

If this happens in the US, a shooting of the messenger will likely occur.

As you can see from people blaming Codex instead of docker here, shooting of the messenger is very much happening.
Post reply on HN