If ever I saw something that made me want to move to a log cabin the woods and never touch a computer again, this is it

Lol, does any of this matter anymore with AI coding? It was hard to get people to care about this sort of thing before ai coding, now its impossible. People in a few years will be coding without even knowing what unix is.

Ok, why don't you work on getting 3.0 out of preview first? 10 min response time is pretty heinous

I agree, according to Googles terms you are not allowed to use the preview model for production use cases. And 3.0 has been in preview for a loooong time now :(

I don't think this argument makes much sense. If you are running down hill towards a cliff then saying that adding a cart to speed up the process doesn't give the cart moral blameworthiness is an unhelpful observation. You can still chose to stop running down the hill or to not get on the cart.

Exactly! Was going to make a similar comment if I didn't already see one. People keep saying things like this and drives me fuckin' nuts. It's not that there are no positives but I don't see how the positives outweigh the negatives.

The irony is that the LLMs are trained on stack overflow and should inherit a lot of those traits and errors.

Yeah, but they don't inherit their rules and attitude.

Really, if we could apply some RLHF to the Stack Overflow community, it would be doing a lot better.

I had the same problem. My Claude md eventually gets forgotten and it forgets best practices that I put in there. I've switched to using hooks that run it through a variety of things like requiring testing. That seems to work better than Claude md because it has to run the hook every time it makes changes.

I really need something like this up for tasks I want Claude to run before handing off a task to me as "complete". It routinely ignores my instructions of checklist items that need to be satisfied to be considered successful. I have a helper script documented in CLAUDE.md that lets Claude or me get specific build/log outputs with a few one liner commands yet Claude can't be bothered to remember running them half the time.

Way too frequently Claude goes, "The task is fully implemented, error free with tests passing and no bugs or issues!" and I have to reply "did you verify server build/log outputs with run-dev per CLAUDE.md". It immediately knows the command I am referencing from the instructions buried in its context already, notices an issue and then goes back and fixes it correctly the second time. Whenever it happens it instantly makes an agentic coding session go from feeling like breezy, effortless fun to pulling teeth.

I've started to design a subagent to handle chores after every task to avoid context pollution but it sounds like hooks are the missing piece I need to deterministically guarantee it will run every time instead of just when Claude feels the vibes are right.

Unfortunately the question of whether we should is not a very popular one right now.

If you always run npm inside of docker does that pretty much prevent attacks like this?

Docker is not a sandbox. There is some work that can be done to harden it, but you're better off looking at genuinely sandboxing your dev environment

What is genuine sandboxing? Everyone waives there hands by saying this

Good question with a lot of possible answers. You can take sandboxing as far as you want, really. I typically just use bubblewrap (linux)

I have a perfect set up in inside docker that works.

I would love to know why bubblewrap is a superior alternative.

Here's mine https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849...

My understanding is that docker escapes are not all that difficult, and your aliases really aren’t doing much to harden the container. but I am not an expert on the matter. I’m sure there is plenty of info online

> My understanding is that docker escapes are not all that difficult,

  1. Show me how you would escape Docker
  2. Show me npm packages doing this in the wild

Google safe browsing violation in 3...2...

This is a relatively obvious universal sentiment with no suggestion as to how to make it happen.