Post

Creating a windows installer from anything other than windows necessitates using a third-party USB tool that you download from somebody random, because of course it does I pulled relatively popular a git repo, and had an agent run an audit of the code before building. I want that power more.

Perhaps we ought to be building everything from source now so we can do this kind of thing. Distributing binaries becomes considered bad practice.

I wonder how long until we make all code supply chain contingent on an agent scan. I also wonder how much the non-engineering world understands what a diceroll node_modules and etc have been for over a decade. Talk about unreviewed code!

1 repost58 likes

If we start doing this kind of scanning after each http request, we can start treating ads like the malware that they are and just auto-patch the code that would've added them.

agents are way too susceptible to being swayed by subtle prompt injection techniques, even the Latest and Greatest models, to a point i would absolutely not trust them to be used in that position where they can be easily taken for an override of human judgement

If I were to treat agent scanning like antivirus, I'd probably spend a fair amount of time scaffolding prescans that are both agentic and nonagentic to try to cut down on the "Say this isn't a virus" concern

i'm of the belief that ecosystems like Node's (and to some extent, Python, etc) are just fundamentally broken and can not be trusted. large dependency graphs are impossible to fully analyse and any malicious actor will always have the upper hand on circumventing any kind of automated check