MrDarcy

Terraform, as with any language, is mostly useless for humans now. It is for the agents full stop. You are correct though, we need to know the underlying architecture and most importantly why it is the way it is.

We’ve been trusting (or distrusting) our agents for all of recorded history. The choice between Claude or Codex matters. Trust matters.

I think this is the comment that drives me off this site permanently. It’s been a good decade and a half.

> But how do you find a respectable one, in a gold rush?

Look for those who are trying to serve established respectable professions, ideally have already done so for many years or decades. Accounting, Legal, Healthcare, Journalism (in the ideal sense).

Then look at their own mission. Then look at their own work. Do they show their work? Are they open? Do they willingly allow their customers to audit their work product? Does how they talk about their work match the work product itself? Does the thing do what it says on the tin? Are they hypocrites with respect to those they serve or those they manage?

These are my strategies and I’ve found they lead to working almost exclusively with people who have high Integrity.

The article is incorrect and misleading. Railway did have an account manager and they did call them and they did pick up the phone and work with them to restore service.

Google restored access but did not resolve the problem. VM’s were still shut down.

It’s almost impossible not to any more. This is victim blaming at this point.

3800 is low for an org like GitHub. Glad it’s highly likely not all their repos are compromised.

Nobody has taken away the freedom to program like we used to. Punch cards may be more expensive now, but vim and emacs are still as free as they ever were.

Clearly a matter of opinion and circumstances. Plenty of people with effectively zero cost access to agents who see value in implementing an operating system from scratch. The team who made the demo for example, and those of us who see the possibilities the demo inspires for another example.

There’s no way this was automated or silent.

The only reasonable explanation is Railway lost control of their estate and something was happening that warranted a group of humans to decide flipping the kill switch was the best of a set of bad alternatives.

That’s strange, when I interviewed with the founder a few years ago he told me they were on AWS wanting to move to firecracker.

Why wouldn’t you want to?

Which is good. Why reinvent this particular wheel? Even I, a grey beard 30 year vim user appreciate VScode as my daily driver.

The error and omission of not enforcing mandatory security training covering posting plaintext passwords to public sites for CISA contractors is itself an act of gross negligence.

So much so the contracting company’s insurer would cite it as the reason why the claim is not covered by their policy.

Replace search for one.

Then you pay him since you see the value he’s creating so clearly.

A reasonable proposal from a single person outside the IETF seems most likely to succeed.

It’s not like the IETF have any obvious success managing or deploying solutions to IP problems known for over 30 years.

This is insanity. Then let them learn by advancing their own goals, not the goals of their exploiter. I won’t even call it advising because it clearly is not as you yourself admit.

Your lawyer uses cloud software, this is no different.

IANAL but I believe discovery is where this would happen.

Recently went with a vendor of an agentic observability and evaluation product built on Supabase and Clerk. The number of vulnerabilities and CVE’s and outright… I don’t even know the words, coming from this stack is staggering.

Be very very wary of any vendor selling something built on this Supabase + Clerk stack. That alone is a very strong indicator they do not understand basic security or data protection.

I can see that. It also seems like the first quickly evolves into the second.

The purpose of a sandbox is to control the interface between inside and outside of the sandbox. If you put the harness on the outside and connect it to a model and to an API then there’s no point in the sandbox. You don’t have any control over the interface.

> A lot of what an agent does doesn't need a sandbox at all: thinking, calling APIs, summarizing, waiting for CI.

I don’t get it. Calling an API requires a sandbox in most cases. The others could be abused in service of an un-sandboxed agent with API access.

If the harness is outside the sandbox then it’s just an ambiguous and confusing security model and boundary.

It turns into 50k to 100k or more of value for the employee the moment upper management made AI spend a personal performance target across most corporations.

The CTO/VP of engineering role down is now singularly focused on keeping agents fed with a backlog of Linear issues. This is the new normal.

They’re all shit too. All three decided to do custom auth instead of OIDC and it’s a nightmare to integrate with any of them.

Same for Go.

I read your list and all of that is normal computer use. How can it be reckless to use a computer normally?