radku
Joined 8 years ago
Karma
24
Submissions
23
Member since
Feb 24
Recent submissions
Comment · 12 days ago
Comment · 2 months ago
Why such a dislike towards DHH? More people using Linux surely is a good thing.
Edit: I was curious and it was a genuine question, not sure why all the down-votes.
Comment · 3 months ago
Can't agree more. I'm working on OSS security tool that can protect you from Shai-hulud, no half measures.
The idea is to have a local proxy that injects real secrets into requests in-flight, so a compromised library has nothing to steal because it never had access to any of your secrets: https://github.com/inflightsec/agent-vault-proxy
Comment · 3 months ago
I almost got a heart attack seeing a bill for 48B USD!
Comment · 3 months ago
I've built a voice app for controlling Claude code / Codex sessions and having a lot of fun with it.
I can start a remote tmux session from my laptop, close the lid, grab my airpods and continue on the same sessions while in a gym or a bicycle.
Planning to open source it soon.
Comment · 4 months ago
I have pretty much almost this exact setup with 2x3090s and with slightly faster DDR4 512GB and 64 core Epyc! [0] I've been enjoying it a lot. Can't wait to give this model a try.
Apart of running local models I use this rig as my main remote development platform. All Claude Code sessions are running there in tmux now. And my fingers can't be happier not having to deal with constantly hot laptop. Not to mention that Claude Code is such a battery hog.
[0] https://medium.com/@rathko/i-built-an-epyc-64-core-512gb-ram...
Comment · 4 months ago
Congrats on the launch!
Will this solution work with services protected by cloudflare turnstile or captchas? Does this involve human in a loop?
Comment · 4 months ago
No privacy policy whatsoever?
Comment · 4 months ago
I'm working on OSS security tool that can protect you form credential stealers (think Shai-hulud and similar) or prompt-injected agent leaking your secrets.
agent-vault-proxy is a local proxy that injects real secrets into requests in-flight, so a compromised or prompt-injected agent has nothing to steal, feedback welcome: https://github.com/inflightsec/agent-vault-proxy
Comment · 4 months ago
Nice work shipping this.
Disclosure: author of a related tool here. I have create agent-vault-proxy for a very similar reason. It also can help keep credentials out of the agent process. The agent gets a placeholder, the proxy swaps in the real secret in transit.
I read them as complementary: action firewall in front, credential broker behind. https://github.com/inflightsec/agent-vault-proxy
Comment · 5 months ago
AI is actually pretty good at finding vulnerabilities in the codebase.
Critical vulnerability in that source code could enable further access to other production systems or databases.
Edit: typo
Comment · 6 months ago
Hope ask.com knowledge can be preserved in open source LLMs for future generations.
Comment · 7 months ago
This could significantly impact security of large parts of web ecosystem.
Perhaps Node.js can switch to a VDP, no-bounty program. From Hacker One: "VDP is designed solely for receiving, validating, and addressing security reports without a paid bounty element"
Comment · 7 months ago
Agreed. Personally I think about it as massaging a text with LLM is like applying filters to your pictures.
The text probably have been based entirely on the internal notes and investigations and is very informative. Would it be better if the OP wrote it entirely by themselves? Not necessarily.
There are ways to try to prevent this from happening in a first place. I wrote kow (keys-on-the-wire) to fix this. Apps only see placeholder tokens. The proxy injects real key from the vault into outbound requests for allowed hosts.
Author here. Apache-2.0. [1] https://keysonthewire.com [2] https://github.com/inflightsec/keys-on-the-wire