upvote

points

by siwatanejo10 hours ago |
comments
upvoteby e1g10 hours ago|
next
[-]
Fair! You don’t actually need to install anything and can just generate a text file with the security profile for sandbox-exec. You can do that online at https://agent-safehouse.dev/policy-builder.html

Alternatively, you can feed these instructions to your LLM and have it generate you a minimal policy file and a shell wrapper https://agent-safehouse.dev/llm-instructions.txt

reply
upvoteby camkego5 hours ago|
parent|
next
[-]
I think if the online builder could have been the whole project, that would be neat! Truly "zero-trust", what I think many HN readers want.

Anyway, thanks for building Agent Safehouse.

reply
upvoteby e1g5 hours ago|
parent|
[-]
That’s a great idea. I think I’ll restructure the entire project to be based around a collection of community managed rules, a UI generator to build a custom text file from those rules, and an LLM skill so people can evolve their policies themselves. The Bash script will remain in the background as one implementation, but shouldn’t be the only way.
reply
upvoteby oneplane10 hours ago|
parent|
prev|
next
[-]
That online builder is very cool, well done!

I've been trying out similar things to help internal teams to use systems and languages like Rego (for Open Policy Agent) to have a visual and more 'a la carte' experience when starting out, so they don't have to jump straight to learning all syntax and patterns for a language they might have never seen before.

reply
upvoteby e1g5 hours ago|
parent|
[-]
Thanks, Codex helped to put that together in like 20 minutes. Try feeding your agent the idea about an interactive config builder, give it the upstream URL with your condos, and see if it can whip up something for you.
reply
upvoteby dummydummy12347 hours ago|
parent|
prev|
[-]
Really like the online builder!
reply
upvoteby Quiark10 hours ago|
prev|
next
[-]
Usually it takes less than 5 minutes to review the shell script that downloads stuff.
reply
upvoteby aa-jv2 hours ago|
prev|
[-]
Do you review every package in your package manager for back doors/trojans - or do you rely on the social circle upstream to do this work for you?

How is this any different than running some random .sh script?

The assumption is that package-manager code is reviewed - that same assumption can be applied just as equitably to wget'ed .sh files.

tl;dr - you are reviewing everything you ever run on your system, right?

reply