I don’t understand why people trust LLMs.
They don’t know how any of it works, and have no reason to ever learn now that they have a magic box, so of course they’re going to do whatever the magic box tells them as long as the magic box gives them what they want.
Claude Code is not a LLM. It’s a regular application communicating with an LLM. It might be very vibe coded, seeing who it is written by, but it’s not an LLM that’s the problem here.
It’s just bad application design.
The bad application design here is allowing an unreliable LLM write access to your repo and to the internet.
And absolutely the LLM is the problem.
You know the LLM gets stuff wrong, yet you put it in charge. Sooner or later, it’s inevitably going to go very, very wrong.
People were wrong to trust it, people read all the stories of it going wrong, and I don’t understand why anybody still does trust LLMs.
It always was a decision to outsource your most valuable thinking to a subscription controlled by companies who were so obviously on the initial stages of an enshittification journey. Why else were they pushing it so very hard?!
“Yeah, sure, some of its towers fall down, but look how fast it builds them, and look at how heavily below cost the initial subscription is! Let’s replace all our institutional knowledge and experience with a random sentence generator that ate stackoverflow! Yay!”
I don’t understand why people vote for narcissistic, fraudulent, criminal, child-raping bullies, either. It was so clearly and obviously going to go wrong.
Doesn’t this all come back to bad code review though? Laike if I saw this in a commit I’d kill the PR and demand they rotate the password now. And also add this to the gitignore
What the fuck is this website?
Are they ripping off HN and AI summarising their posts our what
https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
is this the original?
This is what I thought people referenced for over a decade whenever they mentioned HN because no one pointed me to the actual HN.
y combinator was founded by sam altman and is really mostly AI schill and very boring nowadays
The slop is annoying but it’s getting better.
I didn’t look at hn for half a year because every post was about AI. But now interesting things are popping up again.
Looks at top posts this morning
Yeah, no fam lol
Yeah but at least the top 10 posts also contain non-ai stuff usually
You’re tracing to justify your response lol
And you initially replied with something that had little to do with my response?
That explains why LLMs are so stochastic.
oooh time to pull back the image again :3
The “nothing new, devs always commit secrets” take misses the bit that makes this one nasty: the file isn’t a .env someone chose to commit, it’s an agent settings file that silently accumulates the exact commands you approved, secrets included, and then gets accidently committed with the project because it lives in the repo, so it ends up publically exposed. YSK that’s a different failure mode to a one-off .env leak.
If you use Claude Code (or any coding agent, tbh), the practical fix is boring but it works: rotate anything that was in that file — deleting the file from the repo doesn’t un-expose it, it’s already scraped — then check git history, because the secret is still in there unless you rewrite it. Add settings.local.json to .gitignore, run a secret scanner like gitleaks in pre-commit, and stop using ‘don’t ask again’ for commands that echo tokens or passwords. Also audit the approved-commands list now and then, and keep tokens scoped as tightly as you can so a leak like this is annoying rather than catastrophic. FYI, GitHub’s secret scanning will catch some of this after the fact, but it’s no substitute for not committing the file in the first place.
Fuck off, clanker.
