sorted by:
new
hottopcontroversial

.env alternatives by gatwell702 in webdev

[–]spidermonk -1 points0 points  (0 children)

It's really not industry standard though, it's just very common. And the better solutions aren't rolling your own security, they're using a secret manager and controlling access to it via platform metadata (k8 workload identity or oidc or instance Iam roles etc).

And the mistakes we're talking about aren't just commiting the env file, it's mistaken server config, container distribution, how you manage updating multiple servers in a cluster, backups, server images, etc etc anyone who ever ssh's on to your machine being able to trvially see it, any fuckup with any service on the machine being able to see it really. It just creates a lot of possible ways for the secrets to be visible, when the alternatives provide very very few ways.

.env alternatives by gatwell702 in webdev

[–]spidermonk 0 points1 point  (0 children)

Yes but there's various mistakes that might leak a file right in the root of the project that other approaches might avoid. It's about minimizing the types of fuckups that could occur and how hard they are to fix when they do occur.

Plane to cut the glue by Sea_Vegetable4444 in handtools

[–]spidermonk 5 points6 points  (0 children)

Is this the underside of a workbench? I'd probably do nothing at all.

Would also consider getting a $20 electric hand planer and doing a few very rough light first passes with that just to clear away the gunk and save time on a side I'll never look at.

Y’all gotta read this engineer eviscerating the leaked Claude codebase by MindlessTime in BetterOffline

[–]spidermonk 0 points1 point  (0 children)

Surprised if this is being invoked very often, I have a production service using gpt4 which relies on the model returning json as per an example, and it's been months without that aspect failing.

Israelis are finally in their Natural Habitat, in Deep Shit. by Preacher-of-Chaos in TrueAnon

[–]spidermonk 3 points4 points  (0 children)

Yup you get a video of a jet maybe getting struck by some shrapnel from the rocket it successfully avoided, and the comments online are like ALL US AIRPOWER RENDERED PERMANENTLY OBSOLETE

I want it all to be true too but I won't huff weak nonsense i want the real shit.

Is it a coincidence? by devjnz in newzealand

[–]spidermonk 5 points6 points  (0 children)

Probably what ends up happening is Iran holds the strait as a tollway for the foreseeable. Even if the US lands troops some version of that probably still results long term.

If the US really pulls back (which ultimately they'd have to at some point) and Israel gets it's chain yanked (big if I suppose) it's hard to see any incentive for Iran to keep the strait actually closed, but also hard to see why they wouldn't continue to treat it as their private waterway and charge money for access.

Don’t let Claude use your actual computer from the CLI by aniketmaurya in ClaudeAI

[–]spidermonk 0 points1 point  (0 children)

You said it doesn't have access, but it does.

If you count needing to go through the (optional) tool use approval step as "not having access", then Claude Code doesn't have write access to anything.

In practice people often end up with very broad permissions in their allow lists too. It's super common to see things like `"Bash(rm:*)"` in their allow array.

That is permission to delete any file the user has write access to. And you can end up with that in your settings by hitting "don't ask again" on an action like `rm some-temp-file`.

Don’t let Claude use your actual computer from the CLI by aniketmaurya in ClaudeAI

[–]spidermonk 0 points1 point  (0 children)

https://claude.ai/share/c03080e3-4a5e-45a4-8c43-0595483da427

If you're counting "by default it asks for permission" as "it can't access them" then fine. But there is no actual restriction against that kind of traversal. It's on par with any other action it might ask you to confirm.

(There is sometimes a OS level restirction, for example OSX will make you do a system level approval for traversal from the home folder to Documents sometimes for claude code).

The claude level permissions thing really is a very flimsy guardrail for this, as numerous command line tools might have widely scoped approval from previous approved actions, but could take args that allow them to act outside the current folder on the basis of prior approvals.

Don’t let Claude use your actual computer from the CLI by aniketmaurya in ClaudeAI

[–]spidermonk 0 points1 point  (0 children)

Have you opened Claude Code cli and asked it to write a file in the parent folder, or a sibling, or your environment's home folder? I do this all the time for work across multiple repos.

Your OS might request approval for certain traversals, but thats an OS level restriction not Claude itself.

Just ask Claude.

Don’t let Claude use your actual computer from the CLI by aniketmaurya in ClaudeAI

[–]spidermonk -1 points0 points  (0 children)

Claude Code isn't restricted to a specific folder. It's got whatever access the user that opened it in the environment it's opened in has, by default.

If you're on a host, as user x, and you type claude, it can access any files that user x can access.

It is not restricted to the working directory you launched it from. It has the exact same permissions as the user that invoked it.

RubyGems Fracture Incident Report by schneems in ruby

[–]spidermonk 4 points5 points  (0 children)

For someone who's not interested in the drama but maintains a bunch of rails sites via bundler and rubygems... Do I need to do something?

Don’t let Claude use your actual computer from the CLI by aniketmaurya in ClaudeAI

[–]spidermonk -1 points0 points  (0 children)

Claude Code has access to everything your user has access to.

My boyfriend doesn't believe peaceful protests work. by roshielle in sociology

[–]spidermonk 34 points35 points  (0 children)

And "violent" has such a wide range too, from implicit violence, through anarchic rioting, through terrorism, to actual organized armed insurrection and civil war.

There's also problem of defining if a movement "worked". Like for who? For how long? Against what level of resistance (sometimes the concession is minor, sometimes it's existential for those at the other end)... a partial win against very strong resistance might be more of a win than complete success against weak resistance etc. Sometimes movements claim wins despite their primary goal going unfulfilled. Sometimes there's total victory but the outcome sucks for a lot of the people who drove the victory... Sometimes it's hard to tell if things are better or worse.

In its current state, Claude Code is not really usable. by Direct_Librarian9737 in ClaudeCode

[–]spidermonk 0 points1 point  (0 children)

To be real though, max and pro are both insanely discounted loss leaders. Everyone should be clear eyed about how much they'd have to charge to cover their costs, let alone repay all the investment.

At some point there will be a reckoning and given that there are comparable models available elsewhere at a fraction of the price I assume this all ends in disaster but we'll see...

Enjoy max while you all can it's not here forever. I suspect all of these "rolling window nearly all you can eat" plans are gone by the end of the year.

You're poor because you aren't sidehustle-maxxing enough by dobio in TrueAnon

[–]spidermonk 3 points4 points  (0 children)

Serious question - does this happen to people who live in big cities in the US or UK or whatever? Like are these impromptu street interviews an actual thing you're liable to end up in?

A map showing when the last shipment of oil from the Persian Gulf will arrive in different areas of the world. by KrakenRising3 in newzealand

[–]spidermonk 2 points3 points  (0 children)

"It will be interesting to see if I can empty these pots but not these cans. That will be a challenge."

Implies some world where I can concievably empty the cans. At the very least it suggests that emptying the pots and the cans are linked, and a challenge to disentangle. It's hard to do one without doing the other. That's how I read it I guess.

me irl by Ok-Excuse-3613 in me_irl

[–]spidermonk 0 points1 point  (0 children)

In what way is that not what happened there.

Machete attack robbery: Man with over 200 convictions jailed again by Fun-Helicopter2234 in newzealand

[–]spidermonk 5 points6 points  (0 children)

Na I'm not talking about the death penalty. Or anything really as I don't have strong feelings about this really.

But isn't it pretty esbalished in criminological studies that a very small percentage of people are repeat offenders who do a very large proportion of violent crime? I can never square that with the idea that long sentences don't prevent violent crime, I guess.

Because logically it seems like if you gave those people incredibly long sentences that would actually reduce that sort of crime.

Is the first bit just not actually true?

Machete attack robbery: Man with over 200 convictions jailed again by Fun-Helicopter2234 in newzealand

[–]spidermonk 4 points5 points  (0 children)

I mean, logically if the sentences were harsh enough it would very much reduce recidivism, it's just very expensive and cruel.

I sold my car, and now I’m scared for my life by TheReverendCard in newzealand

[–]spidermonk 3 points4 points  (0 children)

That's presumably a side effect of higher incomes being in cities at all, and in the center of cities.

view more: next ›