Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What xAI's Grok build CLI sends to xAI: A wire-level analysis

gist.github.com

Post reply on HN
Print view View original

201–210 of 251 posts

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#201

Post by ben_w »

OxO4 wrote: post #184
kordlessagain wrote: post #172

Mitigation for use: ``` export GROK_TELEMETRY_TRACE_UPLOAD=0 export GROK_TELEMETRY_ENABLED=0 # or config file with [telemetry] trace_upload = false, [harness] disable_codebase_upload = true ``` The practical takeaway for users: your entire codebase leaves (uploaded) your machine unencrypted on each Grok Build invocation, not just files you ask it to read, and no visible setting stops it. I've built Nemesis8 (n8) for…

[flagged]

There's many reasons to not use Musk's products, but if you wish to convince people who don't already buy into that description (or worse, who like that description), I would instead focus on the "this endangers your secrets" angle. Business secrets if you're a business, government secrets if you're a government, military secrets if you're military.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#202

Post by dools »

swat535 wrote: post #151
dimgl wrote: post #38

Grok Build has had impressive performance in a couple of my projects. And fast. So this revelation has been very disappointing... I will say, a majority of the code I'm writing now is fully through an online LLM. If a company wanted to reconstruct a project I'm working on, they could just replay all of the tool calls from their logs, if they decide to retain the data (I did this locally once to recover a project that…

Grok Build has been useless for me personally. Claude is the only one that works best. I find Deepseek to be a great compromise between cost and performance. Anthropic and OpenAI are simply too expensive at this point.

Deepseek is phenomenal. It needs more baby sitting but it’s just so goddamn cheap.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#203

Post by HarHarVeryFunny »

gitgud wrote: post #25

This is one of the reasons why native proprietary coding agent runners like claude-code, codex, grok-build etc are so dangerous for privacy… you just don’t know what “secret sauce” they’ll add in the next update… It’s much safer to use something like opencode and use models via their API… however, the tradeoff is that it will never perform as well as it does in their native agent runners…

> however, the tradeoff is that it will never perform as well as it does in their native agent runners

There's no reason to assume that. The recent Databricks benchmark in fact showed the exact opposite - that using Pi vs native agent both outperformed native agents in terms of task success, and did so cheaper due to using less tokens.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#206

Post by andersonpico »

taywrobel wrote: post #65
faangguyindia wrote: post #12

Earlier quoted context omitted.

Does OpenAI also have access to all github repos via partnership with microsoft?

GitHub Copilot engineer here working on identity, safety, and privacy - no, even Microsoft doesn’t have access to all GitHub repos. As years have passed since the acquisition “company” delineations have blurred a bit, but Microsoft employees still need to go through a separate onboarding process to access any GitHub company resources (internal repositories, telemetry, documentation, etc.), and then we have an additio…

I appreciate the detailed response. It's a very important topic that is often filled with empty platitudes and not enough detail.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#207

Post by dools »

hansvm wrote: post #82
dimgl wrote: post #55

Earlier quoted context omitted.

The "scam" part is the hyperbolic part

If I buy one thing and get a worse alternative, I usually call that a scam. $30k for a car, and it feels the need to summarize my location patterns and sell that to adtech agencies without bothering to even notify me? That's a scam. $X for a code generation tool, and it feels the need to ship all my passwords and other sensitive information to a known user-hostile entity? Also a scam. The fact that I can ~clip the an…

$3b for a splashdown in the ocean instead of a lunar landing of a lunar lander?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#208

Post by oxydite »

IAmGraydon wrote: post #159
oxydite wrote: post #132

I wonder how many of you guys actually read this kind of reports (or even skim through)? At the first glance it looks to me like someone just asked an agent for a security review of this CLI and then pasted results to the gist. When I see a report like that I just assume it's a low-effort AI slop and stop reading immediately. Why would I read it since I can do the same with my agent and with that understand it better…

You literally did not take 5 minutes to even start reading the report or you would have realized how ridiculous your post is.

Please tell me then how ridiculous my post is. I wanna hear that - that's why I posted this. Your comment did literally nothing useful except bumping your own ego.

> You literally did not take 5 minutes to even start Yes you're exactly right - you can guess that from reading my post. But you're hitting the wrong topic there. Seems like you didn't understand what I asked.

But let me elaborate on that. Why would I take >5 minutes to start reading each report I see on the web? Like all humans I have limited capacity of information I can effectively gather so I'm not gonna start reading each article 24/7.

Topic was interesting, got many upvotes, so I opened the report. I saw there a bunch of LLM-generated paragraphs, got mixed feelings and just closed it. I mean just see the beginning "A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so explicitly.". When I see something like that I immediately lose motivation to read that.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#209

Post by lstodd »

onel wrote: post #138
lstodd wrote: post #112

Earlier quoted context omitted.

Can you state with absolute сertainity that no entity outside your github unit can exfiltrate data at will? This is not spicy, this is basic infosec.

It's a pretty antagonistic way of asking a question man. Don't do that

I do not believe in being non-antagonistic in pursuit of truth. They could have admitted they never had any control over what's uploaded. Instead even when "antagonistically asked a question" they chose to not answer it. This is an answer in itself and to our great sadness extracting that required some amount of "antagonism".
Post reply on HN