425
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub (thehackernews.com)
submitted 2 days ago by to c/technology@lemmy.world
37 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 43 points 1 day ago (12 children)

I don't understand why people trust LLMs.

  • permalink
  • fedilink
  • source
  • hideshow 12 child comments
    •
  • [–] 18 points 1 day ago*

    They don't know how any of it works, and have no reason to ever learn now that they have a magic box, so of course they're going to do whatever the magic box tells them as long as the magic box gives them what they want.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 21 hours ago

    I trust the summaries on my searches as much as I already know or can verify, like any tool, but I don't log into them. I use the anon ones like duck.ai and lumo and if it limits my usage then time to go anyway. If they track me somehow it doesn't really matter since I do no harm and come in peace.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 day ago (5 children)

    Claude Code is not a LLM. It's a regular application communicating with an LLM. It might be very vibe coded, seeing who it is written by, but it's not an LLM that's the problem here.

    It's just bad application design.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 14 points 1 day ago* (last edited 1 day ago) (4 children)

    The bad application design here is allowing an unreliable LLM write access to your repo and to the internet.

    And absolutely the LLM is the problem.

    You know the LLM gets stuff wrong, yet you put it in charge. Sooner or later, it's inevitably going to go very, very wrong.

    People were wrong to trust it, people read all the stories of it going wrong, and I don't understand why anybody still does trust LLMs.

    It always was a decision to outsource your most valuable thinking to a subscription controlled by companies who were so obviously on the initial stages of an enshittification journey. Why else were they pushing it so very hard?!

    "Yeah, sure, some of its towers fall down, but look how fast it builds them, and look at how heavily below cost the initial subscription is! Let's replace all our institutional knowledge and experience with a random sentence generator that ate stackoverflow! Yay!"

    I don't understand why people vote for narcissistic, fraudulent, criminal, child-raping bullies, either. It was so clearly and obviously going to go wrong.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] -2 points 1 day ago* (last edited 23 hours ago) (3 children)

    I genuinely don't understand how is everyone having such a bad experience. Granted, I hardly chat or use it for research, but every task I've given to codex has been successfully fulfilled. Two last ones were optimizing a web page that drew entire world map with lots of details (actually blew my mind, it was like 95% faster) and fixing a mod in a videogame. I've created custom app for a radio station I loved but didn't have basic features like previous songs, I've created an entire web game in 3 hours, I've created mods for games, etc., all without a fail.

    This thing has saved me lots of headache, yes everyone here claims it's so bad and useless and a complete bubble, meanwhile in the last year it has basically only started working and only now can businesses start adapting it (I'm sure early adaptors were not happy)

    EDIT: you just know this comment will receive silent grunts and hardly any real counter-arguments because I'm right.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 19 hours ago (2 children)

    Absolutely it's got a lot better, and it can do a lot of things, but it can also oopsie wipe your entire repo (and be very apologetic afterwards). I can't understand how you've not heard those stories and I can't understand how you would give one executive power if you had.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 17 hours ago* (1 child)

    I've heard people doing that way more often.

    I can't understand how you've not heard those stories and I can't understand how you would give one executive power if you had.

    I don't quite understand why would you even assume this. Codex has no access to repo, network access needs manual approval, it is sandboxed to project directory (backup'ed after every step) and commands (which is mostly PowerShell since I'm on windows) needs reviews and approvals.

    I can only assume the people who got burnt didn't practice basic sanity as you obviously can't trust LLMs

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •