So what stops it from sending a network request to a git repo that pushes what that placeholder resolves to?

How would that work? You don't control github.com servers so your repo would never see the secret.

edit: You may want to look into tokenizing proxies as the general application of this concept.

Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt

It only replaces the token in the HTTP header that is sent to the server. Whatever you wrote in your files isn't touched by the proxy.

It sends a request to requestb.in and reads the public log of the headers. There are ways.

But requestb.in is not api.github.com so the proxy wouldn't replace anything.

Couldn't it then just publish the mock in a public place... it would get replaced by the real secret.? How is this prevented

Maybe the tokenizing proxy could work both ways? If the agent tries to read secret.txt, it gets back the placeholder.

Some of the newer Java features are really nice for this: sealed interfaces, records, sealed interfaces, and record pattern matching

Because the companies did it underhandedly without prior consent? Imagine you walked into a hardware store to grab some lumber, didn't pay for it, and the store had to call the cops to swing around your house? That's hardly the typical shopping experience, now is it?

I think that’s my point: none of those things happened, so on what basis can we claim that it’s like they did. Who has to agree with what you’re doing in order for it not to be considered underhanded?

You seem to have conflated a chemical engineering degree with the concept of baking being a chemical process

No, but baking is still a process that requires skill — and that skill is not 'common sense'.

If making sourdough were 'common sense' then _everyone could do it correctly on their first try_. They don't. Most fail and never try again because the skill level required for sourdough is too high.

I'm an _expert_ cook, but I'm still having to go through the frequent failures of learning how to pickle with brine (fortunately, my failures have been mostly edible and have not turned moldy). Even vinegar pickling requires a certain level of expertise before you can do it successfully, even though that level of expertise is _roughly_ "knowing how to boil water".

Isn't IBM still going?

IBM had something of a downward blip last quarter, partly because of mainframe cycles. But it's actually done generally well the past few years and pays a pretty good dividend. $10B in net income for 2025 isn't shabby.

LLMs rewriting legacy code in newer languages is going to have an impact.

Many years ago I worked a technical support job for Xbox services, and the amount of calls about "unauthorized charges" was obscene. Xbox provided parental controls, but it required the parent to set up their child's account themselves, and many couldn't be bothered.

I imagine the same thing will happen here...

And people give their children cigarettes and liquor, that's bad as well. But that's the responsibility of being an adult. If the adult is deemed not worthy of raising children, society has already established a process of dealing with that too.