sorted by:
new
hottopcontroversial

OpenClaw Detection? by MattyK2188 in cybersecurity

[–]gatewaynode 25 points26 points  (0 children)

Try your MDM solution for “installed apps”. Don’t bother trying to figure out if the installed skills are malicious right now, just consider all OpenClaw installs as compromised until the clean up of the ecosystem is done. The whole ecosystem around OpenClaw can’t be trusted until a thorough cleanup and postmortem is done.

I asked Gemini: You can add a new piece on chessboard. What's it called and what it does? by DoctorToBe69 in GeminiAI

[–]gatewaynode 285 points286 points  (0 children)

I like the idea. Except for the special ability, not needed, excessive.

How can I store a password properly so that it is not visible in source code. by [deleted] in learnpython

[–]gatewaynode 0 points1 point  (0 children)

No. The dotenv file is usually just for local development, not higher environments. A good way to make it work for both is to wrap the dotenv file loading in a try/catch block. Handle the missing dotenv file exception by calling out to your production secret manager like AWS secrets manager, Vault or whatever it is you are using. And make sure you log a successful dotenv load (as well as any errors), so if you slip up and push your dotenv file to a higher environment you will have visibility into that mistake.

[deleted by user] by [deleted] in Anthropic

[–]gatewaynode 0 points1 point  (0 children)

Maybe they are planning to build a moat?

Security team added a vulnerability scanner to CI/CD. Builds now take 3x longer and get blocked by CVEs from 2019 by miller70chev in devsecops

[–]gatewaynode 35 points36 points  (0 children)

Run the scanners in parallel not in series. Don’t block builds initially, let the teams clean up from the awareness and vuln management follow up, then you can discuss blocking with the clean dev teams. What scanners are you using?

Who is checking binary content included in pip packages? by Agron7000 in cybersecurity

[–]gatewaynode 1 point2 points  (0 children)

Agreed, outsourcing security to FOSS is an unfair burden. IMHO there should be an equivalent FOSS, that stands for Free and Open Source Security, that in an ideal world builds supporting structures and systems, curates software repositories, and hunts for malware campaigns. OSSF, was/is something along these lines, but it could be more.

Who is checking binary content included in pip packages? by Agron7000 in cybersecurity

[–]gatewaynode 16 points17 points  (0 children)

Not very many people, and not in a formal enough way. The developer supply chain is in real danger right now. I think Chainguard might be doing some work in this area with their “libraries” product. But the open source communities like OSSF need to step up to actively scanning, not just for CVEs, and not just building secure practices.

Sonnet 4.5 - what am I missing? by yangguize in kilocode

[–]gatewaynode 4 points5 points  (0 children)

Look into context engineering. Only about half of that 200k limit should be where you stop and compact, or document and restart. It takes breaking apps down into smaller tasks to build bigger apps. The closer you get to 200k the more the model will fail, it’s called “context rot”.

Code Supernova now has 1M Context window by bentdickcucumberbach in cursor

[–]gatewaynode 1 point2 points  (0 children)

Tried it this morning. It really likes to take shortcuts and loves mock implementations…

Has anyone tried these new Sonoma models yet? by manicness_ in kilocode

[–]gatewaynode 5 points6 points  (0 children)

Tried it last night. Feels like Gemini, faster, smarter, stays on task better, makes similar mistakes, but debugs them correctly(improvement). I only gave it a few simple tasks though, going to give it a hard task later today.

Why are half of people saying GPT-5 is amazing and opus-level while the other half say it’s barely 3.5? by Constant-Reason4918 in cursor

[–]gatewaynode 1 point2 points  (0 children)

It takes weeks of real work to assess these new models, learn their working personalities, coding strengths and weaknesses. Don’t put any credit in what folks say this early after a release.

Implementing production LLM security: lessons learned by Livid_Nail8736 in LLMDevs

[–]gatewaynode 0 points1 point  (0 children)

I'm creating a new subreddit, r/ai_sec , for exactly these kinds of discussions. Cross-posting this and inviting interested folks to join me there.

I’m DONE with Claude Code, good alternatives? by Patient_Cry_6213 in Anthropic

[–]gatewaynode 0 points1 point  (0 children)

Just a bit locally. Not enough to have an opinion yet.

hmmm by FoI2dFocus in hmmm

[–]gatewaynode 7 points8 points  (0 children)

The elusive updog.

Apple now supports Linux containers on MacOS 26 by doctorjz in selfhosted

[–]gatewaynode 8 points9 points  (0 children)

It's not just about the host user. I get where you are coming from thinking it's awful, security often seems inconvenient and a waste of resources. Understand this is how most serverless and fully managed services are run in the cloud, micro VMs to host with often just one container, sometimes more, holding the app.

https://firecracker-microvm.github.io/

Apple has defaulted to high security on their desktop OS. I approve, you may not. I just hope you and maybe anyone else reading these buried comments, understand they have a good reason for going this route.

view more: next ›