CGamesPlay

That's a terrible distinction to make on a topic about how the coding agent gained root inadvertently.

I'll accept that it shouldn't be default, but just because your web app runs in rootless docker does not mean that root docker has no place. There are several limitations: https://docs.docker.com/engine/security/rootless/troubleshoo...

Amazing that CVE-2026-24061 is basically exactly the same vulnerability, 27 years later.

CVE-1999-0113: https://seclab.cs.ucdavis.edu/projects/testing/vulner/18.htm...

CVE-2026-24061: https://nvd.nist.gov/vuln/detail/cve-2026-24061

And that fact is also true for all of the books on all of the discontinued Kindles.

Given, the kindle won't last 500 years, but the support window is in some senses longer than for those 500-year-old books, which never received a single security update.

14 years support window is so insanely good. But as it goes...

You either die a hero or you live long enough to become the villain.

Sure: https://noslopgrenade.com

https://news.ycombinator.com/item?id=48219992

> For a Fortune 100, to go out of your way to spook investors is the least desirable approach.

The company that had 40 million Azure servers compromised? This is a drop in the bucket, the investors clearly do not care about this.

https://www.microsoft.com/en-us/security/blog/2026/05/18/sto...

Can you cite this? It's not YAML execution syntax, surely Github doesn't do it, the only vector I can see is if you put it unquoted into a shell script inside of a GHA yaml.

That doesn't feel like a repetition at all? You said that the first time there was "traffic loss but without the extra google money", but that this time there's no extra google money either way.

Things on my workstation that the container does not have access to: browser cookies, 1Password cli, SSH keys (even if I allow the SSH agent socket), cargo publish tokens (unless it’s a rust project), npm tokens (unless it’s an npm project), and not to mention anything relating to my other clients (don’t compromise my employer when I vibe install some dep for a random side project).

Which has been around for 22 years now!

Given Anthropic's existing track record of producing terrible hallucinated inaccurate documentation in Claude Code, I'm very curious how Bun will handle this as it continues development. Anthropic probably doesn't care about Bun's external compatibility as long as it runs Claude Code. Will Bun be eventually become "the JavaScript flavor that Claude Code uses"? Will they even bother updating external documentation as it changes? Docs currently live at https://bun.com/reference, but I don't know how much of this is separately maintained documentation versus JSDoc-style generated documentation.

How do you think the GitLab employees felt about it?

I'm also switching back to Obsidian after a few-year stint on Anytype, and the Notebook Navigator plugin is the only one I have installed. This is (I assume) a UI-only plugin, which shouldn't need access to external network or processes, so a quite good candidate for sandboxed plugins.

Proc title is very easily forged (without root even). Obviously a real privileged process could modify the kernel and do whatever it wants, but if I were trying to detect this I would start with /proc/$id/exe.

Would certainly be interesting to learn more about. A simple check: allowlist of known "processes that run as root". Any new process shows up, something happened.

Honestly I'm not really thinking about the boss-programmer relationship, but rather the programmer-agent relationship. At best, you get what fnordpiglet is talking about, where it's a symbiotic relationship. On the other side of the coin, you get a parasitic relationship like the OP is talking about: the agent delivers results, you take credit, you fail to develop (or maintain) long-term skills, you become a non-value-adding middleman, you get replaced.

Exactly this. We need to be more precise than blanket statements like "agentic coding is a trap" and start figuring out what a "tasteful" application of agentic coding looks like. ChatGPT is destroying liberal arts curriculums because students can choose to not do anything of the thinking themselves and produce mediocre work that passes the bar. I think the same problem is showing itself with agentic coding, just with more directly measurable consequences (because the pile of software ends up failing in a more spectacular way than the pile of bad writing).

I've built this twice before. The main problem that I hit is that the AI agents suck at the process lifecycle management: leaving processes alive, starting the same daemon multiple times, etc.

From a brief glance over the code I like the approaches I see. Using the `/etc/resolver/` mechanism is a new trick to me!

The interesting part to me isn't the port numbers, it's the automatic service start/stop, including idle route shutdown.

Many countries, this is often called a golden visa (term predates the current US president).

That's fair (although it doesn't have anything to do with getting "real root" in a userns in that case). I guess one approach would be something like modifying the host's logrotate binary and waiting for it to trigger, or something like that. Would escape the container to root on the host directly. I imagine it wouldn't be a sure thing to pull off, either, but definitely straightforward enough that any APT should be asking Claude to develop it.

> if your model is that linux is just about single-user desktops, this local exploit isn't too bad.

For example, if you have passwordless sudo, you've already got a widely known LPE vulnerability lurking on your system.

It's worth pointing out that you cannot, definitionally, get "real UID 0" in a "rootless" container, because then it wouldn't be a rootless container. This is relevant because this exploit doesn't claim to be able to bypass user namespaces, and that getting "real UID 0" would be a different exploit.

Kubernetes 1.33 switches to user namespaces enabled by default, which I imagine is the same underlying mechanism that rootless Podman uses. `hostUsers: false` is the way to ensure that root in the pod is root on the host. It's trivial for a real (unmapped) root to escape a Kubernetes pod.

It doesn’t? You could easily install the tracker on the client app, no need to do it server side. In fact I bet the app in question (Flo) was doing the upload to Meta client-side.

Claude Code doesn't have an option to use Opus 4.6 any more for me. It was great, but I guess now I have to use it half as much or upgrade my subscription again.

Didn't know that! I tried it and it doesn't work for me, sadly. Test case: `seq 1 100 | bat --pager=builtin` Result: immediate exit, no output printed at all.

https://github.com/sharkdp/bat/issues/1053

Realistically, I will be reviewing a diff, see a hunk I don’t like, change it, and want to see the change back in less. So saving my scroll offset would accomplish my goal. I guess I should add that I want to be able to quit as well?

Like I said, fzf does this. Bind a key to an action that effectively changes the file from stdin to a different command that it runs, while preserving view state.

Bat just uses less internally. And it deliberately breaks less’ handling of ^C, annoyingly.

Is there a name for this style of writing? Where it's composed exclusively of simple sentences. Short and punchy.

Paragraphs with just a single sentence.

I know it's associated with LLM writing. This article probably wasn't written by an LLM. But still. It has a kind of rhythm to it. Like poetry. But poetry designed to put me to sleep.