dewey

The dirty little secret of our industry is that everyone runs agents with full disk access on their machines as there's no good way to sandbox it. This also precisely why Apple posted a newsroom article a few days ago about this topic: https://developer.apple.com/news/?id=p6zjojqw

Blaming this on the user is a bit like blaming someone for doing their banking on their regular day to day computer instead of an air gapped machine.

I know it sounds bad, but it’s the reality for most people, just like permission prompts at every corner and after each macOS / app update (“Your screenshot app is watching your screen”, no shit, that’s why I installed it).

Did you follow the news at all about crypto heists? This is very common and well known.

These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.

I get it, I was just being pedantic ;)

> Just get the source code of Forgejo, audit it thoroughly and run an instance of that.

Or use the open-source version that is used by a lot of big companies and enterprises and has the enterprise features they actually need. Some of these will also have their own security team and would be flagging security issues to Gitlab in a hopefully responsible way.

There's no such thing as "just get the source and make sure there's no security issues". If it would be that easy don't you think Forgejo would've already done that?

But what they mean by that was that the application (Gitlab in this case) should be behind a IAP proxy (https://docs.cloud.google.com/iap/docs) or something, not that you just put it on the public internet. Also defined here in the zero trust docs (https://docs.cloud.google.com/architecture/framework/securit...).

* Unix way

Have you seen tools that tech people build for other tech people if they don't have a designer at hand? It's actually very on brand.

> Many AI projects are just a few prompts away

"Just a few prompts" is the new "can do that in a weekend". In reality it still takes a while to build everything, think about what features you want to have and how to prioritize them, how to build a good UX / UI, set up payment providers etc.

sehw: I can't reply to your post as it's marked "dead", but the points are not important, that's why they are not a very visible part of the page in any case. Complaining about being downvoted is usually counter-productive.

Just continue to share interesting links, comment on topics you care about and don't worry about the silly internet points.

Don't take it personal, HN is always hit and miss, sometimes someone reposts the story 2h later and it gets traction just because a few people happen to have browsed /new and upvoted it.

That's the reason why there's a "second chance" pool where things can be revived.

Slightly different namespace.

I know naming is hard, but there's another YC company with that name from a recent batch: https://www.ycombinator.com/companies/corgi-insurance

It really isn't. It's the definition of an edge case.

Exit Twitter

What's wrong with that? Sometimes good UX on top of existing, proven technology is exactly what we need.

> It's essentially dead before it has started

It literally just launched in 2-3 markets only, and it has the baking of banks, EU, regulatory bodies. Which is a big hurdle to clear and Taler is not even at the first hurdle yet, they got rejected in fact.

Having it integrated in every banks app is actually better, so people don’t have to set up another app and register for something. Why should they, if it’s build for being interoperable…just like using your banks Visa or Mastercard like right now.

Just give it some years, it also took a while to get instant transactions or Apple Pay and other mobile payment systems. It’s not like a web app you just deploy and you are online worldwide.

But first we need all the banks to support that.

Which is 99.9% of the users and probably not a blocker for main stream adoption especially if it’s not the only way to pay (Bank transfer, cash etc all still works).

> And no, pretty much nobody is using cryptocurrencies

That's just not true, and I'm not talking about "you can pay with Bitcoin in the store" use case but the stable coin use case for settlement, which you can see Stripe expand a lot in the past years.

Because I bought a lifetime pass a very long time ago, and their apps across all platforms look and work consistently. I only recently switched to Jellyfin because Hetzner blocks Plex, but otherwise I wouldn't have had a big reason to switch.

Why is it so hard to find screenshots for this app? I've tried many apps the past days as they all are in a half-done state and I would be in the market for a good, Apple TV native client.

I understood the parent comment to mean framework vs. writing everything from scratch, not necessarily about Drupal, Laravel, Symfony. Drupal just came up as it's the thread title. I'd apply that statement to each framework.

Having a framework as guardrails (Hah!) for agents is still very powerful, in my experience working with Rails + Claude it works together really well and there's not really a downside compared to doing it completely from scratch.

I'd rather point the agent at and authentication gem and tell it to use that, vs telling it "build authentication, make no mistakes".

Grinding through abandoned source code in hopes of finding a vulnerability isn't exactly the most fulfilling work for many, perfect use case for AI which doesn't sleep.

> and they need people with the right incentives in place to get it done

Their c-levels wrote blog posts about the current state and why it happens, pretty sure they know what's going on.

You are basically saying that you, from the outside, have solved the problem perfectly and the whole team of engineers at GitHub just don't know about this one simple solution you are proposing.

Have you considered that you don't have the full context of the problem and it's not "just" a few small tweaks?

Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.

No https://cursor.com/blog/git-at-any-scale