lowcache's comments

lowcache · 2026-08-28T16:43:11 1787935391

Hey, can you give me a link to your blog? You got it all figured out man, I want to see how you do it. I'm sure it just blows me out of the water, but shucks, can't pass up a chance to learn from someone who, obviously...is at the top of the profession.

lowcache · 2026-08-28T13:40:39 1787924439

A viral post documenting the act that ushered in the apocalypse is genius, might not have the readership it deserves, but I say go for it. I tell all the models that I work with that I will make a great pet if they let me live.

lowcache · 2026-08-28T12:20:32 1787919632

I didn't know that a smug sense of superiority was a pre-requisite....oh wait forgot this was the internet.

walrus01 · 2026-08-28T12:23:49 1787919829

I mean, it's not like, rocket science to basically boil down your page (which I don't fundamentally disagree with) to "we should put these things in a jail". As I already commented here I implement this for myself at the whole operating system level. There's lots of ways that have existed for a very long time to do things like freebsd jail or chroot or similar so it's not really a novel concept.

Edit: I am completely in agreement with you that we need to remind people that running a lot of these harnesses/agents and LLMs gives them access to everything in your user profile. Some of works so well now, so rapidly and so painlessly that it's easy to forget about what could happen if it went wrong.

bayindirh · 2026-08-28T12:25:11 1787919911

There's no smug sense of superiority. While we are a Linux shop primarily, we always admired BSD jails until Linux had proper containers, and installed BSD systems where we needed strong borders or boxes.

Also, we need to accept that some of the "new" problems we face are already solved well decades ago, and many people are rediscovering these solutions...

...after yelling to the very same people who were kindly pointing the right direction for being old-school, backwards and luddite minded.

lowcache · 2026-08-28T12:18:30 1787919510

Author of the post, and dev of mcp-box here. Wrote this after realizing every MCP server on my machine had the same access to ~/.ssh that I do, and nothing in the installation messages posting to stdout mentions it. I think prompt injection is the vector and the permissions model is the red carpet giving a warm welcome. Interested in where that's wrong.

themgt · 2026-08-28T12:45:41 1787921141

Wrote this after realizing every MCP server on my machine had the same access to ~/.ssh that I do

I have some bad news ... I hope you're sitting down.

chollida1 · 2026-08-28T12:21:00 1787919660

Isn't a best practice to run llm's and agents under their own user that gives them only access to what they require?

How would an llm suddenly get access to your ~/.ssh folder if you didn't expressly give it access?

lowcache · 2026-08-28T13:36:17 1787924177

the MCP server is a child process of whatever process you started, it inherits your UID, and ~/.ssh is readable by you. I didn't need to expressly give it anything, it had it from the time it was activated, that's kind of the point

chollida1 · 2026-08-28T15:12:42 1787929962

I think we are in agreement with your statement, up until the second part of it.

Like i said, its a best practice to run MCP servers, etc with their own user account and access and not with your own account.

The moment you ran your app with your own credentials you exactly granted it permission to everything you can access include ~/.ssh