miniblog.

I've added an eval button to the website of my programming language! It's a been a lot of work to lock down appropriately. It still needs some UI polish but it's so nice to be able to try snippets immediately. https://www.garden-lang.org/

The "line of death", where the browser UI splits between trusted UI elements and UI controlled by the website. Also argues that HTTP warnings are better than HTTPS padlocks, because there's incentive to spoof padlocks lower on the page. https://emilymstark.com/2022/12/18/death-to-the-line-of-death.html

I find it odd that people recommend Docker for sandboxing agentic coding tools. Isn't it easier to just create a separate user account on the machine? It's an established security boundary, and viewing output is easy (just make the user's home directory world readable).