7 ms·

Fun fact: Copilot gives you no way to ignore sensitive files with API keys, passwords, DB credentials, etc.: https://github.com/orgs/community/discussions/11254

Fun fact: Copilot gives you no way to ignore sensitive files with API keys, passwords, DB credentials, etc.: https://github.com/orgs/community/discussions/11254#discussioncomment-12369008 https://github.com/orgs/community/discussions/11254#discussi... So by default you send all this to Microsoft by opening your IDE.

malnourish 6mo ago
I swear I just set up enterprise and org level ignore paths.
- veverkap 6mo ago
  Yeah, it's a Copilot Business/Enterprise feature
0xbadcafebee 6mo ago
Separate fun fact: Gemini CLI blocks env vars with strings like 'AUTH' in the name. They have two separate configuration options that both let you allow specific env vars. Neither work (bad vibe coding). Tried opening an issue and a PR, and two separate vibe-coding bots picked up my issue and wrote PRs, but nobody has looked at them. Bug's still there, so can't do git code signing via ssh agent socket. Only choice is to do the less-secure, not-signed git commits. On top of that, Gemini 3 refuses to refactor open source code, even if you fork it, if Gemini thinks your changes would violate the spirit of the intent of the original developers in a safety/security context. Even if you think you're actually making it more secure, but Gemini doesn't, it won't write your code.
- WatchDog 6mo ago
  Gemini also won't help you with C++ if you are under 18, since it would be unsafe. https://news.ycombinator.com/item?id=39632959 https://news.ycombinator.com/item?id=39632959
  - verdverm 6mo ago
    Is it still true? That's two years old
    - WatchDog 6mo ago
      It's improved significantly in that time, but relative to the other frontier models, it is still the one that is the most condescending and coddling.
- verdverm 6mo ago
  I use Gemini 3 to edit multiple forks. Your statement is false based on stuff I actually do.
  - 0xbadcafebee 6mo ago
    Well it's true based on my running into the issue 8 hours ago
    - verdverm 6mo ago
      Maybe it's your prompts? I've never had Gemini refuse to write any code in any context. I use it with Claude prompts, edited down, in particular to remove guardrails. You shouldn't use Google Ai products, they are inferior. Their models are quite good. It's confusing when people use the model name when referring to a product. What's your setup?
nulld3v 6mo ago
Sadly, this issue is systemic: https://github.com/openai/codex/issues/2847 https://github.com/openai/codex/issues/2847
- stavros 6mo ago
  OpenCode has a plugin that lets you add an .ignore file (though I think .agentignore would be better). The problem is that, even though the plugin makes it so the agent can't directly read the file, there's no guarantee the agent will try to be helpful and do something like "well I can't read .envrc using my read tool, so let me cat .envrc and read it that way".
  - solaire_oa 6mo ago
    This points out that agentic security flaws are worse than "systemic", they're the feature. Agents are literal backdoors. It's so bizarre to be discussing minor security concerns of backdoors, like trying to block env vars. Of course the maintainers don't care about blocking env vars. It's security theater.
sceptic123 6mo ago
Fun fact: you shouldn't have sensitive files with API keys, passwords, DB credentials, etc. in your repo
- nunez 6mo ago
  It’s fine to have them in your repo if they’re encrypted and the private key isn’t in there as well!
- wzdd 6mo ago
  “In your repo” and “in the directory you are running copilot” are two separate things.

malnourish 6mo ago

I swear I just set up enterprise and org level ignore paths.

veverkap 6mo ago
Yeah, it's a Copilot Business/Enterprise feature

0xbadcafebee 6mo ago

Separate fun fact: Gemini CLI blocks env vars with strings like 'AUTH' in the name. They have two separate configuration options that both let you allow specific env vars. Neither work (bad vibe coding). Tried opening an issue and a PR, and two separate vibe-coding bots picked up my issue and wrote PRs, but nobody has looked at them. Bug's still there, so can't do git code signing via ssh agent socket. Only choice is to do the less-secure, not-signed git commits. On top of that, Gemini 3 refuses to refactor open source code, even if you fork it, if Gemini thinks your changes would violate the spirit of the intent of the original developers in a safety/security context. Even if you think you're actually making it more secure, but Gemini doesn't, it won't write your code.

WatchDog 6mo ago
Gemini also won't help you with C++ if you are under 18, since it would be unsafe. https://news.ycombinator.com/item?id=39632959 https://news.ycombinator.com/item?id=39632959
- verdverm 6mo ago
  Is it still true? That's two years old
  - WatchDog 6mo ago
    It's improved significantly in that time, but relative to the other frontier models, it is still the one that is the most condescending and coddling.
verdverm 6mo ago
I use Gemini 3 to edit multiple forks. Your statement is false based on stuff I actually do.
- 0xbadcafebee 6mo ago
  Well it's true based on my running into the issue 8 hours ago
  - verdverm 6mo ago
    Maybe it's your prompts? I've never had Gemini refuse to write any code in any context. I use it with Claude prompts, edited down, in particular to remove guardrails. You shouldn't use Google Ai products, they are inferior. Their models are quite good. It's confusing when people use the model name when referring to a product. What's your setup?

nulld3v 6mo ago

Sadly, this issue is systemic: https://github.com/openai/codex/issues/2847 https://github.com/openai/codex/issues/2847

stavros 6mo ago
OpenCode has a plugin that lets you add an .ignore file (though I think .agentignore would be better). The problem is that, even though the plugin makes it so the agent can't directly read the file, there's no guarantee the agent will try to be helpful and do something like "well I can't read .envrc using my read tool, so let me cat .envrc and read it that way".
- solaire_oa 6mo ago
  This points out that agentic security flaws are worse than "systemic", they're the feature. Agents are literal backdoors. It's so bizarre to be discussing minor security concerns of backdoors, like trying to block env vars. Of course the maintainers don't care about blocking env vars. It's security theater.

sceptic123 6mo ago

Fun fact: you shouldn't have sensitive files with API keys, passwords, DB credentials, etc. in your repo

nunez 6mo ago
It’s fine to have them in your repo if they’re encrypted and the private key isn’t in there as well!
wzdd 6mo ago
“In your repo” and “in the directory you are running copilot” are two separate things.