Earlier quoted context omitted.
[flagged]
In my limited existence on this earth, talk is very cheap and actions should matter more.
Good idea. Start sending in some PRs to contribute then.
Unauthenticated remote code execution in OpenCode
51–60 of 155 posts
Re: Unauthenticated remote code execution in OpenCode
#52Many people seem to be running OpenCode and similar tools on their laptop with basically no privilege separation, sandboxing, fine-grained permissions settings in the tool itself. This tendency is reflected also by how many plugins are designed, where the default assumption is the tool is running unrestricted on the computer next to some kind of IDE as many authentication callbacks go to some port on localhost and the fallback is to parse out the right parameter from the callback URL. Also for some reasons these tools tend to be relative resource hogs even when waiting for a reply from a remote provider. I mean, I am glad they exist, but it seems very rough around the edges compared to how much attention these tools get nowadays.
Please run at least a dev-container or a VM for the tools. You can use RDP/ VNC/ Spice or even just the terminal with tmux to work within the confines of the container/ machine. You can mirror some stuff into the container/ machine with SSHFS, Samba/ NFS, 9p. You can use all the traditional tools, filesystems and such for reliable snapshots. Push the results separately or don't give direct unrestricted git access to the agent.
It's not that hard. If you are super lazy, you can also pay for a VPS $5/month or something like that and run the workload there.
Re: Unauthenticated remote code execution in OpenCode
#53Many people seem to be running OpenCode and similar tools on their laptop with basically no privilege separation, sandboxing, fine-grained permissions settings in the tool itself. This tendency is reflected also by how many plugins are designed, where the default assumption is the tool is running unrestricted on the computer next to some kind of IDE as many authentication callbacks go to some port on localhost and th…
I really like the product created by fly.io's https://sprites.dev/ for AI's sandboxes effectively. I feel like its really apt here (not sponsored lmao wish I was)
Oh btw if someone wants to run servers via qemu, I highly recommend quickemu. It provides default ssh access,sshfs, vnc,spice and all such ports to just your local device of course and also allows one to install debian or any distro (out of many many distros) using quickget.
Its really intuitive for what its worth, definitely worth a try https://github.com/quickemu-project/quickemu
I personally really like zed with ssh open remote. I can always open up terminals in it and use claude code or opencode or any and they provide AI as well (I dont use much AI this way, I make simple scripts for myself so I just copy paste for free from the websites) but I can recommend zed for what its worth as well.
Re: Unauthenticated remote code execution in OpenCode
#54They keep adding features without maintaining the core. I stopped using it when they started selling plans. The main reason for Opencode was to use multiple models but it turns out context sharing across models is PIA and impractical right now. I went back to using Claude Code and Codex side by side. Having said that, there is definitely a need for open platform to utilize multiple vendors and models. I just don’t th…
As someone who uses the two big C's, I can recommend ampcode[0] and Crush[1]+z.ai GLM as an addition. Amp can do small utility scripts and changes for free (especially if you enable the ads) and Crush+GLM is pretty good at following plans done by Claude or Codex [0] https://ampcode.com/ [1] https://github.com/charmbracelet/crush
[deleted]
Re: Unauthenticated remote code execution in OpenCode
#55Earlier quoted context omitted.
My original message was more positive but after more looking into context, I am a bit more pessimistic. Now I must admit though that I am little concerned by the fact that the vulnerability reporters tried multiple times to contact you but till no avail. This is not a good look at all and I hope you can fix it asap as you mention I respect dax from the days of SST framework but this is genuinely such a bad look espec…
the email they found was from a different repo and not monitored. this is ultimately our fault for not having a proper SECURITY.md on our main repository the issue that was reported was fixed as soon as we heard about it - going through the process of learning about the CVE process, etc now and setting everything up correctly. we get 100s of issues reported to us daily across various mediums and we're figuring out ho…
Thanks for providing additional context. I appreciate the fact that you are admitting fault where it is and that's okay because its human to make errors and I have full faith from your response that OpenCode will learn from its errors.
I might try OpenCode now once its get patched or after seeing the community for a while. Wishing the best of luck for a more secure future of opencode!
Re: Unauthenticated remote code execution in OpenCode
#56This is pretty egregious. And outside the fact the server is now disabled by default, once it's running it is still egregious: > When server is enabled, any web page served from localhost/127.0.0.1 can execute code > When server is enabled, any local process can execute code without authentication > No indication when server is running (users may be unaware of exposure) I'm sorry this is horrible. I really want there…
Factory’s droid is pretty good for a cross-provider solution.
[deleted]
Re: Unauthenticated remote code execution in OpenCode
#57They keep adding features without maintaining the core. I stopped using it when they started selling plans. The main reason for Opencode was to use multiple models but it turns out context sharing across models is PIA and impractical right now. I went back to using Claude Code and Codex side by side. Having said that, there is definitely a need for open platform to utilize multiple vendors and models. I just don’t th…
As someone who uses the two big C's, I can recommend ampcode[0] and Crush[1]+z.ai GLM as an addition. Amp can do small utility scripts and changes for free (especially if you enable the ads) and Crush+GLM is pretty good at following plans done by Claude or Codex [0] https://ampcode.com/ [1] https://github.com/charmbracelet/crush
Okay I am genuinely curious by what you mean ads. This is the first time I heard of the concept of ads in something like these code agents
Re: Unauthenticated remote code execution in OpenCode
#58It feels that today security is secondary to growth. As long as your growing, a few incidents here and there aren't going to make a difference.
Well I feel like they will take security more in context from here on out.
Atleast they didnt implode their communications like I see from some other companies.
To be really honest, when you bet on AI agents, I feel like soemtimes you bet on the future of the product as well which is built by the people so you are basically betting on the people.
I'd much rather bet/rely on people who are sensibile in communications in troubled times like this than who implode sometimes (I mean no offense to Coderabbit but this is what comes to my head right now)
So moments like these become the litmus test of the products basically imo by seeing how people communicate etc.
Re: Unauthenticated remote code execution in OpenCode
#59A coworker raised an interesting point to me. The CORS fix removes exploitation by arbitrary websites (but obviously allows full access from the opencode domain), but let's take that piece out for a second...
What's the difference here between this and, for example, the Neovim headless server or the VSCode remote SSH daemon? All three listen on 127.0.0.1 and would grant execution access to another process who could speak to them.
Is there a difference here? Is the choice of HTTP simply a bad one because of the potential browser exploitation, which can't exist for the others?
Re: Unauthenticated remote code execution in OpenCode
#60Seems that OpenCode is YC-backed as well [0] [1]. I would've thought YC would encourage better cyber security practice than OpenCode have demonstrated here.
[0]: https://www.ycombinator.com/companies/sst
[1]: https://anoma.ly/