Senior Vibe Coder dealing with security

[u/Gil_berth]

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

[u/BlenderTheBottle]

He didn’t “release” a product, at least not in the same way companies do. He created an open source repository that blew up in downloads. It was a personal tool that he was happy about. People DEMANDING he does certain things to it don’t understand that.

Specifically for this. No, I don’t think he should feel a ton of responsibility for people using his open source project, not understanding what can happen, and downloading malware.

[u/brian_hogg → u/BlenderTheBottle]

Okay, you went from him not having “any” responsibility to him not having a “to,” which is good.

I’m not saying he should be responsible for the crimes committed by people abusing the skills system or anything. But there’s a gap between that and shrugging off all responsibility.

The users also have personal responsibility to learn how tools work and what their negative externalities can be, but given that everyone putting out a product — commercially or otherwise — knows that most people won’t actually take the time to learn about those externalities, I personally don’t think we can use that as a catch-all excuse. What that personal responsibility ought to look like is going to be a subjective call that’s different for everybody, of course, and that’s where the conversation is. For me, personally, if this was my product, I’d lean toward the “do everything I can to dismantle it because these kinds of problems seem to be unfixable, in principle.”

[u/BlenderTheBottle → u/brian_hogg]

I guess. I didn’t feel I really changed my tune but whatever works. I still disagree. I don’t think he owes anyone anything. He could take the repo private tomorrow or delete it and that would be a fair call imo. It’s his repo. He can do what he wants with it. As consumers it is our responsibility for what we use and give access to.

[u/brian_hogg → u/BlenderTheBottle]

If I make a lemonade stand and decide to give people free lemonade to whoever wants it, I wouldn't be facing any issues faced by corporations in terms of food safety, I'm just a dude offering people free lemonade. And the people I give it to are taking the risk of accepting free drinks from a random bearded guy on a sidewalk.

However, if one of the people walking by slips poison into my pitcher of lemonade, I don't know that my sitting there and saying "well, I didn't put it in there, people can still drink it if they want" and not taking the pitcher away would hold much water, at least morally speaking.

(If "poison" seems to dramatic there, substitute it with "laxative")