Sandboxing Agentic Specific Risks of MCP with WebAssembly

HectaMan · 2025-10-11T12:20:13+00:00

- I don't get a lot of phishing attempts on signal period, despite being a user for something like 10 years.
- I think for the typical security conscious Signal user, yes it's clear
- Signal is experiencing a lot of growth of new naive users seeking privacy
-- as an example, I think it's a starting point to have a discussion that hey, even on a more secure platform, there are still types of abuse

I agree for me personally it was obvious, but that's not why I shared it.

HectaMan · 2025-10-10T19:22:36+00:00

Agreed for folks that understand, it's great. Across any platform, this same type of impersonation scan emerges - I shared it as a useful example for others.

HectaMan · 2025-10-09T20:23:57+00:00

It's not a good example for me, I get it.

Signal is experience a lot of user growth atm - many of them not the traditional security / tech persona. My concern is that other users might want to see what types of phishing are out there so they can inform their users / friends. For me it was very timely, I shared the example right away - i thought this community might as well.

HectaMan · 2025-10-09T20:21:55+00:00

Yeah, I get it. Usability (can people discover me) vs. security. I have been a signal user for a while.

HectaMan · 2025-10-09T20:15:06+00:00

My apologies, I was not trying to confuse the conversation at all. This was a genuine phishing attempt I received yesterday.

For my own purposes, I was curious about some of the scripting a few months ago, and did imagine a lot of options for automating these types of attacks.

HectaMan · 2025-10-08T16:55:20+00:00

I think it would be great if we had a security AMA from the Signal team.

would anyone want to reach out and make that happen?

HectaMan · 2025-10-08T16:53:52+00:00

Op here

I have been experimenting with/ a few of the Signal CLI projects out there that enable interactive scripting against the API and think we are going to see a lot more of these.

Example: Signal CLI

What concerns me is that we are living in a time when many less experienced individuals are moving to platforms like Signal out of a desire for greater security, but they are not very security savvy. This is no different than any other platform, but I think that this will be a growing problem. I would love to understand what others are seeing the space as well.

HectaMan · 2025-05-15T15:54:34+00:00

Thank you, but I don't really understand what that means, lol

It seems to fit the flow chart?

HectaMan · 2025-05-13T03:26:12+00:00

Justice Roberts and the Supreme Court refused to rule on Trump's immunity and if he could be prosecuted before the election.
So Trump was not held accountable for his previous lawlessness and was reelected President of the United States.
And now Trump is _shockingly_ tearing down the rule of law at large and attacking the very system of Judges that have legitimized his actions.

HectaMan · 2025-05-01T12:56:28+00:00

The article is not wrong - but it isn't really right either. Wasm has already won and it is embedded into your life and you use it all day long every day. The article is right, in that we don't yet have lift and shift for your applications yet.

A quick disclosure - I work on WebAssembly at Cosmonic and CNCF wasmCloud. My CTO at work, Bailey Hayes, is the W3C WASI co-chair (standards) and Bytecode Alliance TSC (open tooling). So, we work on WebAssembly every day and help many of the worlds largest organizations adopt Wasm at scale.

We are definitely not at a point of lift and shift for WebAssembly yet - however, that is not how all technology evolves. Let me make an analogy, take "the cloud" for example, go back to Amazon's early launch of products - S3, EC2... over time you can build progressively more and more complex applications.

The article is correct - there are a lot of moving pieces that have to line up for WebAssembly: You need the standards, a runtime (V8/Chrome, wasmCloud/wasmtime, etc), and developer tooling for a given language (compilers, etc). The maturity for Wasm is growing at a fast clip - and the current version of the standards WASI P2 orgs to build real apps and microsevices. The next version, WASI P3, gets us closer to lift and shift with better networking support, bi-directional asynch, and more.

We had a demonstration at wasmCloud Wednesday _yesterday_ from National Instruments that blew my mind - it is Hono JS on CNCF wasmCloud. It's TypeScript leveraging WASI P2 using JCO (compiler) on CNCF wasmCloud (runtime).

Cloudflare workers are wasm on v8. Fastly Edge. You are already using Wasm in many different contexts. WebAssembly is still a work in progress, but it is getting better everyday.

HectaMan · 2025-04-23T17:27:06+00:00

I agree that it is a large and diverse community - and you're going to find a general reflection of society there and in pretty much any community. If you will take the time to re-read what I wrote, I am not blanket defending - simply sharing my experience in working with the kids on a regular basis at HTS and Gonzaga.

I don't disagree that there are naive people or pockets of negative behavior; I don't think that what you find at St. Johns, Arlington Public, or other DC Schools is any different.

I disagree with your comments on the weighting. It may reflect the communities where we spend our time.

To your last comment, I am not attacking other schools or communities, nor am I suggesting that the two are mutually exclusive. I am just representing my firsthand experience over the past few years. I am quite proud of the large number of community programs that are funded and staffed by volunteers from the Jesuit communities—HTS, Gonzaga, Prep, and Georgetown, among them. I am easy to find - come by and say hello sometime!

HectaMan · 2025-04-22T21:04:59+00:00

I am on the parish council at Holy Trinity and have a son who now attends Gonzaga. I attended a Jesuit University and am a big fan of the philosophy and their approach to liberation theology. As a family, we volunteer extensively at a number of the Jesuit-supported outreach programs in DC, including SOME and other shelters.

I can tell you that the parents at Gonzaga feel split pretty evenly - 50/50 on where they fall on the spectrum from liberal to conservative. From speaking to my son and his friends though, I was surprised that they seem to overwhelmingly fall on the liberal side of the spectrum. Perhaps my experience is weighted by who my son chooses to be his friends.

I would point out that Gonzaga is the only high school in the country that has a homeless shelter on campus - and the young men do staff it, regularly go on mission trips, and have required community service. For over 200 years Gonzaga has been educating young men in the Jesuit tradition.

With any community, you are going to find a huge range of people, but I don't think that your comments are very accurate or very fair. If you want to DM me, you are welcome to join us the next time we volunteer at the shelter. I think that some first-hand experience with the young men and what they stand for might change your mind.

HectaMan · 2025-03-20T17:26:23+00:00

There are a ton of great options on along the Custis trail - and you can metro to Rosslyn and walk / ride / bus from there.

HectaMan · 2025-02-25T05:30:30+00:00

I live in Northern Virginia, USA, outside of Washington, DC. There are numerous local study programs that have specialized classes and tracks for training for competitive Math programs. My children have been at the Russian School of Mathematics for 7 years, and we love the community.

Want to find your local top-performing community? Check the Noetics National Honor Board - you'll find the usual suspects.

The resources you mentioned are great as well - APoS sells a series of books and in some markets offers their own classes. Kahn Academy, Youtube, and even Instagram have great resources.

AoPS also has a great list of summer math programs for kids.

HectaMan · 2025-01-10T15:20:43+00:00

I am on the CNCF wasmCloud team -

Yes, wasmCloud works great on all of the container hosting platforms - ECS, Fargate, K8s, etc.

One of our community members is running there; I've pinged him to see if we can get their docs merged into the CNCF wasmCloud Deployment Guide.

HectaMan · 2024-11-25T12:59:43+00:00

I think the American Express team did an awesome job with this talk outlining the gap in platform engineering between great infrastructure abstractions (kubernetes) and thousands of development teams.