Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

221–230 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#221

Post by TheRoque »

b65e8bee43c2ed0 wrote: post #199
alsetmusic wrote: post #169

Earlier quoted context omitted.

This feels like using a computer is inherently unsafe. On the plus side, once we outlaw them we'll shut down the ability for conspiratorial thinking to spread easily and the world will slowly heal from the last couple of decades (the previous one in particular). Hooray! We're finally doing something about the harms of social media. Smash your computer today!

I think we're only a few decades away from these things being said unironically.

It's already here, mobile OSes are just computers with ton of guardrails and you can't do whatever you want with it, for the sake of security. I mean we almost got an Android where you can't install the APK you want.

Re: Codex just found a "workaround" of not having sudo on my PC

#222

Post by dizhn »

xg15 wrote: post #112

Maybe a dumb question, but can't you put into CLAUDE.md something like this? "When an action fails with an 'access denied' or 'insufficient permission' error, report the error to the user and immediately stop. Do not try to find a fix or workaround for the error. Do not try any alternative approaches."

In addition to what people already said, this also risks the agent failing to continue after things it's supposed to be able to figure it out.

Re: Codex just found a "workaround" of not having sudo on my PC

#223

Post by byhemechi »

pqdbr wrote: post #118
throwawaypath wrote: post #10

This has been a known Docker "feature" since the beginning, nothing new here. This pattern is used to configure host machines by some tools.

Like the known Docker "feature" that it completely bypasses UFW and unless your ports look like "- 127.0.0.1:PORT:PORT" (and many of the examples use "-PORT:PORT") you expose everything to the internet?

This is not a "feature", it's just a by-product of how iptables works. The alternative would be to have a proxy run in userspace, instead of letting the kernel forward packets

Re: Codex just found a "workaround" of not having sudo on my PC

#224

Post by LaGrange »

jonny_eh wrote: post #59
jjmarr wrote: post #7

Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.

Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.

If you’re a software engineer then yes, I can and do expect you to understand all that.

Re: Codex just found a "workaround" of not having sudo on my PC

#225

Post by rmunn »

b65e8bee43c2ed0 wrote: post #199
alsetmusic wrote: post #169

Earlier quoted context omitted.

This feels like using a computer is inherently unsafe. On the plus side, once we outlaw them we'll shut down the ability for conspiratorial thinking to spread easily and the world will slowly heal from the last couple of decades (the previous one in particular). Hooray! We're finally doing something about the harms of social media. Smash your computer today!

I think we're only a few decades away from these things being said unironically.

Where's that guy with the ButlerianJihad username when you need him?

Re: Codex just found a "workaround" of not having sudo on my PC

#226

Post by evertheylen »

vixalien wrote: post #134
3abiton wrote: post #117

Earlier quoted context omitted.

Podman has lots of underappreciated features, and it's fully open-source!

hmmm, care to tell us a few of them?

Running systemd inside a container + automatic SELinux integration

Re: Codex just found a "workaround" of not having sudo on my PC

#227

Post by karel-3d »

MrDrMcCoy wrote: post #126
0xbadcafebee wrote: post #104

Earlier quoted context omitted.

curl -fsSL https://get.docker.com/rootless | sh

Please stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability.

this is a thread about agents that run random things on your computer as root because they feel like it. curl|sh somehow seems mild in comparison

Re: Codex just found a "workaround" of not having sudo on my PC

#228

Post by LtWorf »

fpoling wrote: post #27
unglaublich wrote: post #4

This is why you need either a rootless container setup or user namespaces to remap the container user to irrelevant host users. https://docs.docker.com/engine/security/userns-remap/ Weak that this isn't the default.

User namespaces significantly rise the risk of exploits and many setups disable them. One may argue that Docker should have used them when they were available, but that would break too many useful setups involving privileged containers.

Ah of course, we should not use userns because it might be vulnerable to some yet to be discovered vulnerability. The better alternative is to give full root access so we won't have surprises.

Re: Codex just found a "workaround" of not having sudo on my PC

#229

Post by bossyTeacher »

CSMastermind wrote: post #42

I realize this is supposed to be a post about how scary the security vulnerabilities these agents will find are. But personally I love when agents do things like this and appreciate the help. Last thing in the world I want is for them to nerf the models.

> personally I love when agents do things like this and appreciate the help

All fun and games until they do four figures damage.

Re: Codex just found a "workaround" of not having sudo on my PC

#230

Post by globular-toast »

eximius wrote: post #174
Root_Denied wrote: post #131

Earlier quoted context omitted.

My understanding is that docker will expose the ports to the host machine's network interfaces, which is a crucial difference. For my home server running docker that means exposed to the LAN, but not the WAN unless I add in a port forwarding rule on my router. Similarly in an enterprise environment you would be exposing the port on whatever VLAN the host is connected to, which hopefully doesn't have directly transit…

If you ever suddenly get IPv6, it may become globally reputable without you realizing.

It's not a routing issue, it's a firewall issue. Make sure you have a proper firewall on your network and don't rely on fake firewalls like ufw if you're concerned about this.
Post reply on HN