Hacker Newsnew | past | comments | ask | show | jobs | submit | CER10TY's commentslogin

Only for public repos though - if you're in an org with private repositories you don't get access to them (yet).


You do, you just have to set them up at the organization level. Windows/Linux/macOS are all available.


Personally, I'd just use common sense and good judgment. At the end of the day, would you want someone to hand your address, and other private data to OpenAI just like that? Probably not. So don't paste customer data into it if you can avoid it.

On the other hand, minified code is literally published by the company. Everyone can see it and do with it as they please. So handing that over to an AI to un-minify is not really your problem, since you're not the developer working on the tool internally.


Presumably they'll threaten to sue you and/or file a criminal complaint, which can be pretty hard to deal with depending on the jurisdiction. At that point you'll probably start asking yourself if it's worth publishing a blog post for some internet points.


Personally, I'd expect Claude Code not to have such far-reaching access across my filesystem if it only asks me for permission to work and run things within a given project.


Apparently they were using --dangerously-skip-permissions, --yolo, --trust-all-tools etc. The Wiz post has some more details - https://www.wiz.io/blog/s1ngularity-supply-chain-attack


That's a good catch. I knew these flags existed, but I figured they'd require at least a human in the loop to verify, similar to how Claude Code currently asks for permission to run code in the current directory.


This confusion is even more call for a response from these companies.

I don't understand why HN is trying to laugh at this security and simultaneously flag the call for action. This is counterproductive.


Probably because "HN" is not an entity with a single mind, but rather a group of millions each with their own backgrounds, experiences, desires, and biases?

Frankly it's amazing there's ever a consensus.


Talk to people outside tech. Lots of small problems worth solving, but not in tech. Also, just because it's a problem in someone's day to day won't mean they'll pay to fix it.

Good luck!


"just because it's a problem in someone's day to day won't mean they'll pay to fix it."

The best way to measure is that they've hacked a solution themselves using inferior tools. This is where the 10x recommendation comes to mind - you can do it cheaper, faster, better.


Well, if they have hacked a working solution that is supposedly free, why would they pay for another one?


Isn't that pretty much how every "Trusted by these companies" marketing badge works nowadays?


Or, far more likely, they'll reach out to someone in their network. To land in that network, you have to market your services. LinkedIn is somewhat useful for that, but less so nowadays.


I guess the thinking goes like this: Why start a business, get a higher paying job etc if you're getting ~2k€/mo in UBI and can live off of that? Since more people will decide against starting a business or increasing their income, productive activity decreases.


I see more people starting businesses because they now have less risk, more people not changing jobs just to get a pay hike. The sort of financial aid UBI would bring might even make people more productive on the whole, since people who are earning have spare income for quality of life, and people with financial risk are able to work without being worried half the day about paying rent and bills.

It's a bit of a dunk on people who see their position as employer/supervisor as a source of power because they can impose financial risk as punishment on people, which happens more often than any of us care to think, but isn't that a win? Or are we conceding that modern society is driven more by stick than carrot and we want it that way?


If everyone has 2k/mo then nobody has 2k/mo.


That's like saying "money doesn't exist".

In a sense everybody does have "2k" a month, because we all have the same amount of time to do productive things and exchange with others.


Props to you if you manage to follow this and squeeze it into 15 minutes. I‘ve genuinely never had a daily last less than 60 mins.


Your team needs coaching, then. Unless you're getting status from 30 people....which would be a whole other conversation.


I‘m long gone from that team (thankfully). But hey, the Scrum Master was certified, I‘m sure it‘s all proper /s


"Scrum" is one of those terms like "jam band" or "martini" or "DevOps" that people apply way too liberally to describe things that they think are similar but are actually completely different. If you try and get people to do real Scrum ceremonies and roles as written you'll run into a host of excuses as to why they can't (or, as is more often the case, just don't want to). This is how you end up with a "daily stand-up" that only happens when Jupiter isn't in declination, is attended by between 0 and n + 3 people where n is the actual team size, and lasts up to an hour and a half with a strong possibility of not everybody giving their required status. Oh, and everybody is sitting down. At a stand-up.

Scrum might not be perfect for every situation but it's a damn sight better than a swirling miasma of agenda-less quasi-recurring meeting invites buttressed by orphaned Google Docs and Slack threads. I've worked on exactly one team where we pretty much did Scrum to the letter and it was great. Meetings were short and sweet and we always knew what we had to build or fix. I was just a kid and we were using a super-janky tech stack but it was among the most productive, low-stress times in my career.


We do something really similar to this and we're usually through 6 or 7 people in 15 minutes


Yeah, we do this basically automatically right now, so it is fast. There are really rare cases when we would need more than 15 minutes. We do more serious stuff asynchronous over Slack or in a smaller round after daily with only affected people.


that's insane. how many of you are there?


We were 5 people total - PO, Scrum Master, 3 devs. Been years since I was in that team but it was expected that everyone would give a lengthy update about the previous day


That's 12 minutes a person. How much time did it take 3 devs to say "I worked on 12343, I plan on working on 12354, no blockers"? I assume it was the PO/SM that drug it out?


Product managers shouldn't be rebranded as "solution managers." The title suggests they can handle solutions, but most lack the chops to solve real problems effectively.


I meant "Scrum Master".


That takes 2 seconds. But the PO usually expected a detailed breakdown of what went well or bad and what could be improved right then and there. Simply saying "Yeah, I'm doing X, still doing it, bye" would be bad, because you're also not inviting _collaboration_.


> _collaboration_

_micromanagement_


The issue is that it‘ll absolutely _suck_. If I tell Claude Code to scaffold a web app from 0 outside of React it‘s terrible.

So no, imho people with no app dev skills cannot just build something over a weekend, at least something that won‘t break when the first user logs in.


They will build it, deploy it, get hacked and leak user data.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: