Hacker News Reader

Comment by verdverm | Hacker News Reader

I'm in the same boat. I was the primary advocate for fixing the config security regressions in the OpenCode tool (separate from the console hack days after the fix). My impression is that they are improving quality across the board. I will not being updating to v2 because I do not jive with the new UX. I would recommend checking it out, it's the best open harness I've used so far, though I'm only interesed in TUIs.

I'm currently using the Pi harness as well, it's closer to OpenCode v1 with a few plugins. However, I have zero faith in their security or maturity after several communications with the CEO. Pi is also developed by an Israeli team, if that is something that matters to you, re: Mossad concerns or Palestinians rights.

I'm going to go back to my own custom harness and do a full rewrite, now that I have seen what 6+ other harnesses offer.

View on HN

Security is not the harness' job, it's the sandbox's job. These are two different tools, you need both of them.

harness have a say in security too, sandboxes are one part of posture, but not the only one

You can decide for yourself: https://github.com/earendil-works/pi/issues/10895

Anthropic, OpenAi, and OpenCode all support this feature, we have non-developers to support and MDM is widely used.

For comparison, this excellent reply from Aiden on the OpenCode team: https://github.com/anomalyco/opencode/pull/54921#issuecommen...

Anthropic, OpenAi, and OpenCode all support this feature

... which is a foolish mistake.

Also, they have an economic incentive to make themselves the kitchen sink.

> which is a foolish mistake

Why do you think it is mistake?

How do we provide org / ops determined configuration that users and agents cannot change while still giving them some flexibility to set the values we do not determine?

Last time I checked Pi is developed by Austrians?

We may both be partially right, the main dev I interacted with has Tel Aviv on his GitHub (also 'Hanna' being around the project, but apparently that is a surname not a first name, and a mistaken extrapolation on my part)

https://github.com/davidbrai

https://github.com/earendil-works/pi/issues/10895

The lack of professionalism or seriousness was mainly in a private email chain with Armin. He added a single comment to this issue after that chain which was the gist of a couple of his replies, less snarky. Either way, the interaction left me disappointed, not a founder who seems interested in listening or learning imo.

I see, thanks for clarifying.

I think you are more right than me, so thank you for clearing up my understanding

That's alright, was just wondering if I missed something. Not that interested in being "right".

Reply on news.ycombinator.com