positiveblue

8 ms·

1.
by positiveblue 1y ago
It’s wild, decades of work on least privilege and delegation, and we’re back to handing out root credentials to bots T.T
2.
Stop giving your AI Agent admin credentials(positiveblue.substack.com)
5 points by positiveblue 1y ago|1 comments
3.
by positiveblue 1y ago
Adoption is definitely the hardest "cryptographic" problem :D You can think about this as a new auth token to add in your stack. It does not need to grow and take over the world overnight. We have seen how hard it is to change the
4.
by positiveblue 1y ago
Wafers are definitely inspired by Macaroons, but the core difference is that delegation is tied to identity. In Macaroons, anyone who holds the token can tack on caveats. In Wafers, only the current holder can extend it, and they can explic
5.
JWTs and OAuth suck for AI agents. Meet Wafers(positiveblue.substack.com)
3 points by positiveblue 1y ago|5 comments
6.
by positiveblue 1y ago
TLDR: JWTs say who you are. Wafers say who this request is on behalf of and exactly what it can do.
7.
by positiveblue 1y ago
I could not give less of a shit between whitelist/allowlist. I use them indistinctly. You can sleep peacefully today but you should try to don't over stress from how other people write on the internet
8.
by positiveblue 1y ago
100% needs to be done at the last mile.
9.
by positiveblue 1y ago
Hi, "this person here" Cloudflare will block that request that has a jwt because "it does not come from a person". What I was trying to say is that even the discussion "is this a bot 100% sure or not" makes no
10.
by positiveblue 1y ago
many people don't remember/know history though
11.
by positiveblue 1y ago
yep, that's why I am writing this now :) You can see it in the web vs mobile apps. Many people may not see a problem on wallet gardens but reality is that we have much less innovation in mobile than in web because anyone can spawn a we
12.
by positiveblue 1y ago
I know the image, what I do not understand is the argument between using it being incompatible with "fairness" and "openness"
13.
by positiveblue 1y ago
No
14.
by positiveblue 1y ago
Where everyone needs a cloudflare account to be able to pay*
15.
by positiveblue 1y ago
> An allowlist run by one company that site owners chose to engage with. Exactly, no problem with that, just hinting that's not a protocol. > But the irony of taking an ideological stance about fairness while using AI generated c
16.
by positiveblue 1y ago
The point is "should everyone just have an account with Cloudflare then"
17.
by positiveblue 1y ago
This is one of the main points :+1:
18.
by positiveblue 1y ago
I actually thought about this before publishing it hahaha Good thing they are not the only place to post!
19.
by positiveblue 1y ago
Narrator: but he did put effort... Anyway, main take aways for you: - We REALLY need a way to tie identity to agent/requests - The idea of registering with cloudflare to be able to access a website is bad - Sites should be able to bloc
20.
The web does not need gatekeepers: Cloudflare’s new “signed agents” pitch(positiveblue.substack.com)
454 points by positiveblue 1y ago|489 comments
21.
by positiveblue 1y ago
Giving an agent full access to your data without clear guardrails is a really bad idea. We automate checkouts for e-commerce stores and work with very sensitive information, but our agents never see the real data. They only fill forms with
22.
by positiveblue 2y ago
Well, the answer is "I do not know" Now, if I had to guess, this are "a new kind of cookies" so they just took a name that went with it (like they did with biscuits https://www.biscuitsec.org/ ) There are
23.
by positiveblue 2y ago
Unfortunately, that is so complex and changes so often that should not be implemented at protocol level, but around it. P.S: I feel you :)
24.
by positiveblue 2y ago
Disclaimer: I am the founder of Fewsats, former Lightning Labs employee and owner of the L402.org domain I'd like to clarify a few points and add some context to the discussion. 1) Protocol: While the current implementation of the L402
25.
by positiveblue 2y ago
Well, paywall her can also mean any subscription or even credits-based system like SaaS or Compute APIs (AI inference for example) not only for content.
26.
Adaptive Table (randomized data structure)(github.com)
2 points by positiveblue 7y ago|0 comments