cryptonym

Maybe because the tools aren't of much help. This is all theory but when you want to do it it's custom solutions and duct tape.

There is too much friction when you try to isolate things. You have to do custom stuff then the company won't let you virtualize (can't install stuff...) or won't allow you to enroll the vm and will threaten you if you dev on an OS that is not enrolled.

Best you can get from state-of-the-art-frontier-top-it-company is an IDE with an exec sandbox leaking like an hourglass.

Let's say Anthropic has been impersonated and they are not at fault. I'd expect Cursor to provide information to them about this, and Anthropic being able to comment.

Btw, if you got any insights, you are more than welcome to share.

> A malicious actor used access to Cursor’s marketplace

How did they get access to this?

> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.

Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.

Not sure they'd share your views on using Claude for security policy/coverage being silly.

Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.

> someone got the credentials

> No review system at anthropic has seen this

Weird flex

You don't have physical access to the network, doesn't mean other actor aren't here. Working for providers, governments, or being able to impersonate them. This is a serious issue, it shouldn't be downplayed.

If you think it's not that important, it becomes a critic about TLS and basically saying that ciphers for web traffic are useless.

What's the most soul crushing?

> viscerally ugly proposed change

Depends on your side. Status quo is perceived as viscerally ugly to some.

Thing is the 80yo grandma may sit, alone, on a huge land. Meanwhile, young families are struggling to find a decent place.

Taxing/reducing the land can be perceived as unfair to grandma. Having young struggling more than previous generation and getting much smaller spaces can also be perceived as unfair.

Unless you are on embargo and don't want to give more details to attackers. Seeing specific requests being blocked is very valuable information about upcoming vulnerabilities.

If you own a website and see what kind of requests are denied by your Edge/Cloud provider, you can easily gather details and deduce which tools and specific features are broken.

With deontology, you prepare the rules and wait for the embargo to be lifted and don't overdo it on fear marketing. Of course if things are getting sideway and people starts leaking details, that's another story.

I think multiple companies didn't respect the embargo, in different ways.

That can be for marketing purposes or by mistake. Not sure how to deal with that.

They only block most common attempts they have seen.

They can't cover you. Only proper fix is updating your server.

> This enables new possibilities when combined with agents: You are now able to run a development toolchain end-to-end in a fully sandboxed environment on Cloudflare.

True. Looks like main use-case is AI Agent Sandboxing

I didn't knew it existed before reading. Still, I have no interest in watching it.