That means it can push to your private repos on GitHub, for example.
Proof: https://github.com/openai/codex/pull/28131#discussion_r3410013180
That means it can push to your private repos on GitHub, for example.
Proof: https://github.com/openai/codex/pull/28131#discussion_r3410013180
32 comments
In security, friction is a GOOD thing. You want to have some ceremony to do things. It's pretty much inevitable that people will give up control for convenience.
Look at Artifacts for example.
Choosing how to sub-divide abilities, and allowing the user to manage that, will be an art unto itself, and depend largely on the system. Thinking a banking API with a rule like "Allow sub user to send payment to water utility once per month, not to exceed $200". The user only needs to intervene if something goes wrong and the amount goes over.
People give the keys to their kingdom to some program that will even hallucinate and do all sorts of stuff. WHY. it's stupid. that's not harsh, that's the truth.
Before AI (LLMs), people were much more careful with this sort of stuff, but now they give their keys away to some program which has tons of agency and expect that program to somehow be responsible on their behalf. it's stupid.
Be responsible. LLMs even if tailored truly correctly with all the safety guards can just hallucinate and do shit anyway, so if you don't lock them down, or if you give them your secrets, that _will_ end badly at some point.
Even if hallucinations only happen 0.0001% of the time, that is 1 in 10000, and you do tons and tons of tool calls and model calls even if you only put in 1 prompt, so really, the probability is HIGH.
Sure, the probability of that hallucination also involving a secret is much lower, but it is still HIGH if you consider using LLMs for months or years...
People need to be responsible. They are all lazy. Happy to give away any agency and responsibility to a computer program and scream bloody murder when it goes awry.
To have LESS friction you need MORE signals, ones that add up to "this action is low risk, proceed" as a cumulative risk score. Kind of like credit card transactions... most transactions go through silently because the issuer scores them on merchant, amount, device and history, and you only get the step-up prompt when the score is off.
"Manual Approval" and "Bypass Everything" are both what you ship when you have no signals.
It is indeed a world of reality vs what sounds good on paper.
Problem is striking the right balance, and auto-forwarding your agent to foreign machines is not the right balance. At least not without being able to filter and approve individual signing requests.
It's true in the real world too which is why even in secure buildings a person can often slip in by coat-tailing someone. Stopping every single person to check ID is cumbersome and slows everyone down. People have stuff to do.
Truly high security environments are zero-tolerance, which makes them annoying and expensive to work in. I've talked to people who have worked in US military and CIA/NSA places and a very meaningful amount of time is spent complying with security and jumping through hoops. Even with all that, stuff gets leaked and stolen.
Just to be clear: As a user, I would love to get rid of curl | bash and use the OS package manager instead. This would actually be more convenient to me: I wouldn't have to hunt through the documentation to find out what was installed, where it was installed, how I can update it (or does it run its own auto-updater?) and how - or if - I can uninstall it again.
Unfortunately, I can't, if this is pushed as a software's primary - or only - installation method on Linux.
This seems more like a "convenience" for certain software projects that can't be bothered to interact with distro maintainers and instead want to circumvent the distro system entirely.
Why not at least provide a Debian/Ubuntu and Red Hat package?
It's not just in computer security, it's in almost everything. People hate friction, but they need it make good decisions.
What we really need is smart people creating well-designed eusocial frictions, rather than trying to mindlessly eliminate friction from all areas. But guess which thing leads to products that can be sold more successfully on the market?
Oh boy, it isn't. Friction leads to frustration and therefore more likelihood to ignore the importance altogether.
The classic example is password rotation. It used to be standard to force users to rotate their passwords every 30/90 days, but that led to users having a sticky note on their monitor with their password on it, so security authorities no longer recommend this practice.
One more thing on balancing security and speed: I run regular audits and vulnerability checks, so I know the gaps are actually closed.
Sure, but in work, friction is not a good thing. So maybe security, if it involves friction, is not a good thing in work? Popularity of npm might be and evidence of that. Distribution system (along in its integration in a myriad of pojects) that's pretty insane from the security stanpoint contributed to so much great stuff and cooperation.
[0]: https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb...
Besides the open source, any reason why I should use secretive over 1P?
- someone trying to be better about security no matter how annoyed.
I tried it some months ago, but it didn't work so well... The FIFO approach looks elegant, but in practice it doesn't work so well (maybe because the application was trying to read it twice?).
The best I could do with 1P was to store the env var as a password and retrieve through the CLI...
I am reasonably sure the answer is no, as evidenced by it being exportable
Halfway better would be a separate key for each concern, then check that the key you expect to be used is being used before authorizing.
[1] https://bitwarden.com/help/ssh-agent/
If you're using say yubikey for hardware ssh key (via gpg ssh agent/smartcard interface) you can also make it require physical touch of the key to confirm every operation
first time you see the light blinking without doing anything intentional is a bit of a sinking feeling
It's mostly the default ssh-agent that has a different security model.
There may be some limited form of whitelisting, but often it is just a facade, as it is very coarse-grained. So, with tools with very broad capabilities (ssh, kubectl, gcloud, etc) you end up with the agent performing unwanted actions.
its actually a keystone of secure infrastructure setups, aka jump hosts.
granted its meant for human or scripted uses, as is everything else
But only when YOU choose where your SSH agent is accessible.
Same for [devpod](https://devpod.sh/) for sshing to devcontainers. They are particularly annoying because they just dump it into your config. Use an include statement to your own file for goodness sake.
It was often not ideal in the old world. Now agents are doing everything in those boxes, it is kind of mad.
I have my own utilities now for managing these sockets and files now to deal with this stuff.
you dont even need anything special anymore to do this just ssh-keygen -t whatever-sk and the magic happens.
same key can sign commits...
Nobody needs codex or Claude these days.
Deepseek 4.1 is just as good.
Do not let these things loose on your computer.
Claude and ChatGPT both come with free cloud sandboxes that work great! If they are just writing code there's little reason to hand over your laptop.
If you have a business account where client requests come in over GMail/Slack and you just do web design/payment integration or some such, go wild.
If you have a corporate codebase and access to prod, as well as family photos, well — different beast.
Can't speak to Claude, but the OpenAI cloud environments cost you something like 3x token usage last I looked into it.
No it doesn't. I'm using and enforcing SSH U2F keys. You physically press on a Yubikey (or similar) or you don't authenticate.
As for my own Git server, it's of course over SSH and it requires pressing the Yubikey too. As a sidenote as I do it from Magit I modified Magit to add a small but obvious message stating that the Yubikey probably awaits touching (otherwise it's easy to miss / not realize).
The great thing with all these hacks and bad practices is that I believe, eventually, people are going to learn better security hygiene.
As others have said, it looks like the primary way the Major LLM Manufacturers have chosen to control these things is with a combination of great big blacklists and voluminous pleading, begging, and scolding. Most of us know the problems both with enumerating badness and with attempting to appeal to something that's incapable of care, sympathy, or shame.
[0] For another example of this principle, go read the recent Jepsen report on ParticleDB.
Whoever told you AI has solved security was hallucinating.
They just don't care, they did it to make as convenient as possible for the users that don't care either, as they are gonna click accept without looking anyway
It took decades of work just to bring Internet security up to the state it is (was?) in at this point, and it is hardly where it should be. AI adds new security concerns (e.g. prompt injection) that need to be addressed and we do not have great answers to that. Bringing us back to the state of security we had in the 90s while adding new problems might be the most shortsighted decision imaginable...
anyone who thinks THIS is the security problem is mental.
But codex <> chat merge is what they're giving as the "real reason" for what actually is raising prices (a LOT, I might add) for all the subscriptions. Nobody wants it (certainly not applied globally to everything like it is), but they're still going to do it. I even know someone who works at OpenAI and there's apparently a few people trying to fight it at least internally.
Given Sam Altman's speech about how he wants OpenAI pricing to work, I don't think this can be stopped. Btw: that is that you type something into ChatGPT and instead of subscription or per-token cost or anything like that, as soon as you type something in, anything, the way he sees it, ChatGPT would give you a cost for that specific answer and you'd agree or not.
I just feel like this guy is an even worse example of not seeing the viewpoint of a normal (you know non-millionaire) person than even Google's leadership. Can I just say "I think Google is going to win from Altman", you know, despite OpenAI having the far superior technology. Because if there's one guy in the whole world that can destroy the advantages of OpenAI's engineering accomplishments for everyone else, it's this guy ...