https://news.ycombinator.com/item?id=50075319
https://news.ycombinator.com/item?id=50060694
what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.
of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg
Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.
Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.
Our read on the situation is too much eyes and brain free coding, that they assumed the ai redesign of the configuration system was sound. It took a couple of PRs and explanations for them to bring the system to a better place, such that MDM config was respected at the highest priority.
I do give the OpenCode team a lot of credit, at least Aiden, for the handling of this case.
https://github.com/anomalyco/opencode/pull/51337#issuecommen...
I'm now trying to get the Pi harness to support MDM, but it is not going well... see this and please consider sharing your perspectives or support there