Having recently gone through this exercise with our IAM vendor to secure our MCP service, OAuth DCR scares me in that context. With redirect flows, which are usually what you're using when you're plugging your MCP into an agent, the spec says nothing about how to secure that. I really don't want to allow just anybody to register a client with an arbitrary callback. That's opening us up to phishing. Register your client with a malicious callback url and then trick users into clicking a link that initiates that flow. Our legitimate idp will authenticate them and then send then hand their access tokens off to an attacker.
The spec handwaves around this talking about initial access tokens which a client would obtain first in order to register but the details are sparse and probably unworkable when we're talking about every end user being a client.
Ideally i would be able to specify an allowlist of redirect patterns so i could limit it to say, chatgpt or whatever else. But that would be a non-standard behavior so my IAM vendor isn't in a hurry to do it.
Because Etsy is not a general second-hand marketplace. Its niche is artisans making small batch items. And making your own thing at the scale of ebay is not exactly a small feat.
I am going to ask a question that I’m a little scared to ask because I suspect it’s really dumb, but here goes: is it at all feasible or practical to have a way to jettison a runaway battery from the aircraft? I guess most of the time the problems happen because nobody knows there’s a problem before it’s gotten too out of control for that.
I'm familiar with this strategy but there's one thing about it that I don't understand: After death, the loans are an estate liability, right? Doesn't the estate need to be settled before heirs get their inheritance? If i had an outstanding $1MM loan, wouldn't the estate need to liquidate some of that $RIVN at the $67 basis in order to pay the loan? and then whatever $RIVN was left over would go to the heirs at a stepped-up basis?
Do we need to wait for a tragedy before we do something? Good on the airlines and regulators for recognizing a burgeoning problem and taking action before (hopefully) it leads to unnecessary deaths.
> In reality, it's more like the Fellowship of the Rings trying to make it to Mt Doom, but that realization happens slowly.
And boy to the people making the decisions NOT want to hear that. You'll be dismissed as a naysayer being overly conservative. If you're in a position where your words have credibility in the org, then you'll constantly be asked "what can we do to make this NOT a quest to the top of Mt Doom?" when the answer is almost always "very little".
I'm not an expert on the legal mechanisms but I believe it's a combination of all of those things through a hodgepodge of various local zoning regulations which the article references: limits on the number of unrelated people living in the same home where the limit varies by locality (i've always heard of these as anti-brothel regulations). Limits on number of leases in a single space or requirements for each leasable unit to have its own bathroom and/or kitchen. Requirements that each tenant have their own parking space. Lots of creative ways cooked up by local regulators across the vast USA to discourage anything but single-family homes occupied by single families.
Even what you described (single lease, 4 roommates) is very common and usually allowed but the single lease part is what self-limits the impact of boarding-house type places. You need to find 3 other people to go in on this place with. You need to trust those other people and coordinate lease payments and utility payments and deal with it when some of them to decide to move on. That's a headache!
I think it's well and good to try to address that problem too, but it does seem like a different, although not entirely unrelated issue. What you're describing is already happening now, it's just happening in public spaces (transit stations, parks, etc) where it affects everyone.
I take your point, but I think your hypothetical is a wonderful example of Hyrum's Law. And for that reason, if I was going to go to the trouble of mapping my internal v7 uuids into something more random for public consumption, then I'd be sure generate something that doesn't look like a uuid at all so nobody gets any funny ideas about what they can do with it.
I think you should embrace a bit of ambiguity. Don't treat this like a stupid computer where you have to specify everything in minute detail. Certainly the more detail you give, the better to an extent. But really: Treat it like you're talking to a colleague and give it a shot. You don't have to get it right on the first prompt. You see what it did and you give it further instructions. Autocomplete is the least compelling feature of all of this.
Also, I don't remember what model Copilot uses by default, especially the free version, but the model absolutely makes a difference. That's why I say to spend the $20. That gives you access to Sonnet 4 which is where, imo, these models took a giant leap forward in terms of quality of output.
1) Completely separate in your mind the auto-completion features from the agentic coding features. The auto-completion features are a neat trick but I personally find those to be a bit annoying overall, even if they sometimes hit it completely right. If I'm writing the code, I mostly don't want the LLM autocompletion.
2) Pay the $20 to get a month of Claude Pro access and then install Claude Code. Then, either wait until you have a small task in mind or your stuck on some stupid issue that you've been banging your head on and then open your terminal and fire up Claude Code. Explain to it in plain English what you want it to do. Pretend it's a colleague that you're giving a task to over Slack. And then watch it go. It works directly on your source code. There is no copying and pasting code.
3) Bookmark the Claude website. The next time you'd Google something technical, ask it Claude instead. General questions like "how does one typically implement a flizzle using the floppity-do framework"? "I'm trying to accomplish X, what are my options when using this stack?". General questions like that.
From there you'll start to get it and you'll get better at leverage the tool to do what you want. Then you can branch out the rest of the tool ecosystem.
The spec handwaves around this talking about initial access tokens which a client would obtain first in order to register but the details are sparse and probably unworkable when we're talking about every end user being a client.
Ideally i would be able to specify an allowlist of redirect patterns so i could limit it to say, chatgpt or whatever else. But that would be a non-standard behavior so my IAM vendor isn't in a hurry to do it.