thomas34298

> reduce the risk of data exfiltration

Yet, their tools such as codex are able to read ALL FILES on my PC without explicit permission unless you spawn them within a container: https://github.com/openai/codex/issues/2847

It seems like OpenAI stealing sensitive data from their customers is not a big problem for them as it has been reported as an issue for almost a year now and currently has the 2nd most upvotes among open issues (they work on issues based on upvotes, so they claim).

Does that version of Codex still read sensitive data on your file system without even asking? Just curious.

https://github.com/openai/codex/issues/2847

That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.

Codex can read any file on your PC without your explicit approval. Other agents like Claude Code would at least ask you or are sufficiently sandboxed.

Interesting fact: Codex has access to all the files your current user has access to as well, even if you just opened it in the src directory.

Sam tweeted "taking care of my kid in the hospital":

https://x.com/sama/status/1895210655944450446

Let's not assume that he's lying. Neither the presentation nor my short usage via the API blew me away, but to really evaluate it, you'd have to use it longer on a daily basis. Maybe that becomes a possiblity with the announced performance optimizations that would lower the price...

Have you even tried it out locally and asked about those things?

>BUGFIX: Don't ignore SSL errors (sledgehammer999)

>https://www.qbittorrent.org/news

There should be a security notice IMO.

Changelog: https://typst.app/docs/changelog/0.12.0/

Recently, I decided to try out Claude for a month and bought the subscription right when mine for ChatGPT ended. However, after just a few days, I noticed how sluggish and inconvenient Claude feels on the web. Maybe it's partly because of my 4k screen, and it's not optimized for it, but I quickly switched back to ChatGPT due to the IMO better UX. Also, temporary chats are missing!

Most important changes starting November 1, 2024:

- OSCP+ will replace regular OSCP with a three-year expiration (old lifetime certificates remain valid)

- Removal of bonus points to improve fairness

There is a lot of porn. X even added official rules for it: https://help.x.com/en/rules-and-policies/adult-content

I don't have an iPhone, but I know that you can access it via the official app from Google Play.

I think the same argument could be made for Twitter/X. The app stores by Google and Apple specifically disallow pornographic material, yet the app is full of it. Once you're big and important enough, the rules mostly don't apply for you anymore. Of course, if they tried to circumvent the app store tax directly within the app, there would be consequences, but as long as Google/Apple can make a profit, it's okay it seems.

Not everything revolves around scientific journals and their archaic rules. For my team Typst was a perfect LaTeX replacement and we've been happy ever since we switched. It is easier to understand, has faster compile times and is more powerful without enabling shell escape. However, we're not in the business of writing scientific papers, we write technical reports for our customers. If it wasn't advertised as a LaTeX replacement, we might never have found out about it.

FWIW there is already partial LaTeX support for Typst via the mitex package:

https://github.com/mitex-rs/mitex

I'd say a strict Content Security Policy (at least script-src 'self' WITHOUT unsafe directives) is even more important to keep the impact contained, so you'd have to put your scripts into separate files - as opposed to using inline scripts. It obviously won't help against "HTML injection" in general, but will shield your users from malicious scripts as long as you make sure that an attacker can't just upload scripts on the permitted origin(s).

Here is an example: https://www.wordfence.com/blog/2020/05/nearly-a-million-wp-s...

That is what happens if you are the WP admin and think that you don't need to update your plugins because "it's just XSS, nothing major".

>Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones.

I remember Telegram not publishing their Android source code for extended periods of time, which caused Telegram-FOSS to be significantly behind:

https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/1...

I'm not up to date on the current state of affairs, but I hope this has improved since then.

JS in SVGs can be dangerous, but you can mitigate it using a CSP or by sending "Content-Disposition: attachment" so the file will be downloaded instead of being executed in your current browser context.