Comment by greenicon
4 days ago
Unfortunately, opencode v2 still has mandatory remote config loading from your model provider's .well-known/opencode url, which gives your model provider remote code execution on your machine.
4 days ago
Unfortunately, opencode v2 still has mandatory remote config loading from your model provider's .well-known/opencode url, which gives your model provider remote code execution on your machine.
"s" in "opencode" stands for security.
You should't really run a coding harness on your host computer anyway, because it is impossible to protect yourself from prompt injections and from an incredible amount of security vulnerabilities in the vibecoded plugins.
Security is fundamentally unachievable in popular coding harnesses.
The only right way to use it is in an isolated environment.
This isn't really true. You're talking about unattended execution, where the user doesn't review each action before letting the model proceed. I agree that it's bad to run that on a machine with important data, but I disagree that coding harnesses are fundamentally insecure just because the practice of reviewing each tool call has gone out of fashion. I do see harnesses these days not designed with that in mind, but that just makes those particular harnesses insecure, not the fundamental idea of harnesses as a concept.
Okay, let's use a stricter definition: coding harnesses are inherently insecure.
2 replies →