Recent submissions

Comment · 14 hours ago
Things are awful for this at the moment. [Was the same for docker desktop at some point.](https://rupertrutledge.com/posts/docker-sbx-s-ssh-security-i...)

Same for [devpod](https://devpod.sh/) for sshing to devcontainers. They are particularly annoying because they just dump it into your config. Use an include statement to your own file for goodness sake.

It was often not ideal in the old world. Now agents are doing everything in those boxes, it is kind of mad.

I have my own utilities now for managing these sockets and files now to deal with this stuff.

Comment · 3 days ago
Reading these comments makes me wonder if people really understand the way harnesses work.

Any information that they have access to is fair game. The only way to avoid this stuff is to sandbox them and manage their context (ie. don't let anthropic put a ton of junk on the front of all your inference calls).

Almost certainly there are services out there that are scraping more important keys in similar ways...

Comment · 26 days ago
Very cool.

I've used fastmail similarly for ages. An issue I have found is services that are really hung up on your email being your id, with annoying coupling like assuming you can only access a meeting if the email invite is the same "user" as the VC you're using...

Comment · 12 years ago
You have to be careful using iptables dropping rules on the OUTPUT tables, as this manifests itself ( at least on our systems ) as failed send socket calls (which are often retried by the application), rather than true packetloss. Netem tends to work as expected.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton