Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

251–260 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#251

Post by saidnooneever »

jonny_eh wrote: post #59
jjmarr wrote: post #7

Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.

Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.

no its not. its like expecting people to know how car work before trying to drive it.

not reading terms might see copyright being broken.

not reading manuals and warnings will get all your livelihood stolen by hackers.

different ballgame different focus.

Re: Codex just found a "workaround" of not having sudo on my PC

#252

Post by arjie »

I had a similar experience where I have a DB user who only has access to some parts of the DB and I use Claude Code to answer queries. On one occasion, unable to answer something, it used kubectl to try to get a secret out of a prod cluster. I was watching at the time, since that was a time I used to do that, and so I just hit Esc and interrupted it[0] but ever since then I've had little scripts in my repos that launch kubectl-backed Claude Code instances for this sort of thing. They can't really do anything. They're kubed in.

0: Ha, Eliezer, I just pulled the plug! ;)

Re: Codex just found a "workaround" of not having sudo on my PC

#253

Post by antonkochubey »

dymk wrote: post #170
SpaceNoodled wrote: post #156

Earlier quoted context omitted.

This feels like using Docker is just inherently unsafe.

That’s what rootless docker is for

rootless docker's networking (slirp4netns) is still terribly buggy and in edge cases often locks up using 100% CPU until you discover that your laptop is a lapwarmer and kill it

Re: Codex just found a "workaround" of not having sudo on my PC

#254

Post by antonkochubey »

bestham wrote: post #240
zahlman wrote: post #233

Earlier quoted context omitted.

`which sudo`? `/usr/bin/sudo`?

If they can override sudo, they can override which.

if you use \which it'll always be a shell built-in ;) though someone can put a different shell in your .zshrc

Re: Codex just found a "workaround" of not having sudo on my PC

#256

Post by altmanaltman »

jonny_eh wrote: post #59
jjmarr wrote: post #7

Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.

Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.

The very basic thing about software engineering is to know what the f you're using to build your project. You don't need to be an expert but if you're blindly installing whatever you want on your machine from a "checklist of things to install" without absolutely having no idea what the things being installed are, it is 100% on you. You don't need to be an "expert" to understand this, you need to be "somewhat competent," and that is a very low baseline tbh.

Re: Codex just found a "workaround" of not having sudo on my PC

#258

Post by jolmg »

antonkochubey wrote: post #254
bestham wrote: post #240

Earlier quoted context omitted.

If they can override sudo, they can override which.

if you use \which it'll always be a shell built-in ;) though someone can put a different shell in your .zshrc

  $ which() { echo foo; }
  $ \which
  foo
The backslash only prevents alias expansion.

Re: Codex just found a "workaround" of not having sudo on my PC

#259

Post by latexr »

NotPractical wrote: post #206
HeWhoLurksLate wrote: post #140

Earlier quoted context omitted.

wait so just being lazy and using sudo on Docker commands instead of figuring things out actually means I'm being safer? awesome.

No, because a malicious AI agent could just replace the sudo binary in your path with one that collects your password and uses it to execute arbitrary code as root. Nothing short of sandboxing everything or just never using AI agents or proprietary software will prevent this.

> Nothing short of sandboxing everything or just never using AI agents or proprietary software will prevent this.

Using open-source (non-proprietary) software won’t necessarily save you either. XZ is open-source and it was basically dumb luck that we weren’t all infected. Same with the myriad exploits to NPM.

Re: Codex just found a "workaround" of not having sudo on my PC

#260

Post by dada216 »

byhemechi wrote: post #223
pqdbr wrote: post #118

Earlier quoted context omitted.

Like the known Docker "feature" that it completely bypasses UFW and unless your ports look like "- 127.0.0.1:PORT:PORT" (and many of the examples use "-PORT:PORT") you expose everything to the internet?

This is not a "feature", it's just a by-product of how iptables works. The alternative would be to have a proxy run in userspace, instead of letting the kernel forward packets

which is what podman does with pasta
Post reply on HN