Hacker News Reader

Comment by estearum | Hacker News Reader

I like Instinct because I like the idea of trusting a 22 year old founder who won't (or can't) describe the security model of something that has all your credentials. Completely fucking hilarious that people are using that shit. Fits the stereotype for VCs though!

View on HN

Yea, I'd be very happy with these systems if I could vend and rotate tempary read only credentials to these agents.

I can't get a read only API key for my YouTube, Gmail, Outlook etc etc accounts. Only full admin access via a browser.

I can get r/o creds for things like GitLab and AWS and K8s, which means I'm very happy to let my agents run wild at work because I know for certain they actually can't do any damage, they can read all they want but can only go as far as opening and MR that I can review and merge.

Well, you could intercept those (gmail etc) requests locally, run fast local classification, and deny anything you don't like. Meanwhile, you can still grant some non-zero level of access and get the agentic benefits?

It's actually hilarious to only read on this page intermittently, after not engaging for like 3 weeks I'm presented with 3 new product names that all read like a comedian wrote their marketing. The blatant disregard for security and privacy to push out something most developers have utter disrespect for, I really wonder what the target audience is, cause I cannot relate one bit.

When you come to hn you're inundated with people whose entire lives seem to be using it, when I go to the bar and see non-tech people they're using it as psychiatrists or for recipes or have no idea how to incorporate it into their life and joke about how stupid it is.

I feel very far ahead of this stuff, I went through and built my local llm stack (omlx/pi) 3-4 months ago and haven't touched it much other than to try the recent qwen3.8 and its coming out too fast to keep up with and test etc. I have to download 40gb model files to test each release to go back to my old setup. It's not fun to work on at all. Tweak to hell to get a 10 token bump.

It makes me really wish I could see inside the office of a frontier company, but I don't want to feel like I play tech on a stressed out pro sports team right now. I can't imagine doing infra/systems for these companies is fun.

This stuff is going to get so many peoples systems hacked, we already have that clickfix malware everywhere convincing people to turn on llms in their terminals on a webpage error. Just give them a dot engine and let loose.

It's obviously a tragedy when non-sophisticated users provide their credentials without understanding the repercussions, but there are sophisticated users as well, and these hopefully only provide access and data they can bear to lose.

But the browser lets you store credentials in local storage, what’s the problem?

You're not asking this seriously arent you? Local storage follows strict security policies, go read the spec

Vibe coded apps storing api keys in local storage is a trope at this point isn't it?

That would be dumb and dangerous. That said local storage is used by all major frameworks/libraries for storing jwt tokens of the current session

Sarcasm is always hard on the internet. But yes, it’s a bad idea which was my point

Reply on news.ycombinator.com