←back to thread

224 points azhenley | 1 comments | | HN request time: 0.238s | source
Show context
athrowaway3z ◴[] No.45076822[source]
I don't see the case for, what IMO is, more complexity by creating a virtual machine.

We have user accounts, Read/Write/Exec for User/Groups. Read can grant access tokens which solves temporary+remote requirements. Every other capabilities model can be defined in those terms.

I'd much rather see a simplification of the tools already available, then re-inventing another abstract machine / protocol.

I hope we'll eventually get a fundamental shift in the approach to software as a whole. Currently, everybody is still experimenting with building more new stuff, but it is also a great opportunity to re-evaluate and, at acceptable cost, try to strip out all the cruft and reduce something to its simplest form.

For example - I found an MCP server I liked. Told Claude to remove all the mcp stuff and put it into a CLI. Now I can just call that tool (without paying the context cost). Took me 10 minutes. I doubt, Claude is smart enough to build it back in without heavy guidance.

replies(5): >>45076903 #>>45076940 #>>45077041 #>>45077538 #>>45077773 #
1. jondwillis ◴[] No.45076903[source]
I’m with you for the most part. A lot of, but certainly not all or the security risks are present regardless of whether or not you’re in a VM.

I think defense in depth will eventually matter more, but there are a LOT of low-hanging fruit for attackers right now when it comes to turning AI agents against their users, which is what I think you’re alluding to!