Counting down to the next Linux LPE 0day or KVM vulnerability that agents will use to trivially escape their "sandbox".
Might need a re-think about whether if Linux is still fit for purpose on sandboxing in the first place given its memory model is riddled with C-style security issues.
It's got nothing to do with the licensing, but it used to be 'with enough eyes all bugs are shallow' for code developed in the open.
Now, open code allows anyone with tokens to burn to analyze it for hidden weaknesses. That makes publishing code a risky move unless you've already invested a lot of effort in securing it.
Very frequently when troubleshooting things with an agent it goes off, grabs a compiled library or executable from the system, decompiles it and figures out the exact bug, a possible solution, and if there are workarounds I can apply before upstream fixes it.
rvz · · focus · HN ↗
Might need a re-think about whether if Linux is still fit for purpose on sandboxing in the first place given its memory model is riddled with C-style security issues.
lukehandcool · · focus · HN ↗
jasomill · · focus · HN ↗
I’m sure there are proprietary systems with fewer memory safety vulnerabilities than Linux (and many others with more).
bzzzt · · focus · HN ↗
Now, open code allows anyone with tokens to burn to analyze it for hidden weaknesses. That makes publishing code a risky move unless you've already invested a lot of effort in securing it.
ben_w · · focus · HN ↗
* I don't know how useful any of the specific benchmarks on this are, so I'm only saying "seem to be"
cassianoleal · · focus · HN ↗