1
00:00:00,000 --> 00:00:03,600
Thanks to Jellypod for helping make this
daily show a reality,

2
00:00:03,640 --> 00:00:08,400
because we are looking at a classic
security nightmare on shared systems.

3
00:00:08,440 --> 00:00:12,640
I mean, think about it, you have got a a
shared development server or maybe a

4
00:00:12,710 --> 00:00:18,480
staging box, a multi user C I C D runner,
and you are running Codex.

5
00:00:18,620 --> 00:00:23,280
But to do that, you have traditionally had
to export a global environment variable,

6
00:00:23,320 --> 00:00:27,360
the O P E N A I A P I K E Y.

7
00:00:27,540 --> 00:00:30,400
And that, uh, that is where the nightmare
starts.

8
00:00:31,256 --> 00:00:32,536
Oh, absolutely.

9
00:00:32,936 --> 00:00:34,596
It is a massive bullseye.

10
00:00:35,156 --> 00:00:40,236
If that key is just sitting there in the
environment, literally any local process

11
00:00:40,297 --> 00:00:44,536
or, like, some script running on the same
box, or even another unprivileged

12
00:00:44,596 --> 00:00:50,017
developer, they can just read slash proc,
or run printenv, or even just look at the

13
00:00:50,097 --> 00:00:53,956
active process table, and boom, your key
is gone.

14
00:00:54,636 --> 00:00:58,956
Next thing you know, your enterprise
security is compromised and you are looking at

15
00:00:59,056 --> 00:01:00,616
a runaway billing statement.

16
00:01:00,917 --> 00:01:01,557
Right!

17
00:01:01,577 --> 00:01:05,797
And it, it, it actually ties right back to
what we were talking about recently with

18
00:01:05,817 --> 00:01:08,997
the Multi Agent version two encryption,
remember?

19
00:01:09,237 --> 00:01:15,637
In that version, OpenAI stabilized the opt
in multi agent V two experience with

20
00:01:15,692 --> 00:01:20,757
configurable sub agent models, and they
encrypted the payload between agents to stop

21
00:01:20,803 --> 00:01:23,317
people from, you know, stealing prompts.

22
00:01:23,477 --> 00:01:28,677
But even with all that fancy payload
encryption, if you are on a shared server,

23
00:01:28,717 --> 00:01:32,037
you still had this massive gaping hole at
the shell level.

24
00:01:32,165 --> 00:01:35,877
Like, the raw keys themselves were just
totally exposed.

25
00:01:36,435 --> 00:01:41,375
Right, so you secure the communication
between the AI agents,

26
00:01:41,875 --> 00:01:45,114
but you leave the front door of the server
wide open.

27
00:01:45,734 --> 00:01:48,255
That is, uh, that is a huge disconnect.

28
00:01:48,875 --> 00:01:50,234
So, how did they fix it?

29
00:01:50,375 --> 00:01:52,654
What is the actual, you know, defense
here?

30
00:01:53,000 --> 00:01:57,080
Well, they introduced this brand new tool
in the latest Codex release.

31
00:01:57,240 --> 00:02:00,840
It is called codex responses api proxy.

32
00:02:01,053 --> 00:02:06,680
It is this incredibly tight, lightweight
proxy binary written in Rust.

33
00:02:06,800 --> 00:02:10,280
And the way it handles the key is, is
really elegant.

34
00:02:10,413 --> 00:02:14,920
It only reads the key once, right from
standard input when it starts up.

35
00:02:15,133 --> 00:02:19,320
So it never shows up in any command
history or process list.

36
00:02:19,500 --> 00:02:24,920
And then it immediately scrubs its own
environment using the env u command.

37
00:02:25,296 --> 00:02:30,216
Wait, so it reads it once from stdin and
then wipes it?

38
00:02:31,036 --> 00:02:33,496
But, I mean, what if it gets swapped to
disk?

39
00:02:33,996 --> 00:02:38,017
Like, if the server memory gets low and
the operating system page file writes it to

40
00:02:38,036 --> 00:02:38,736
the hard drive?

41
00:02:39,083 --> 00:02:39,683
Ah!

42
00:02:39,723 --> 00:02:40,843
That is the cool part.

43
00:02:41,056 --> 00:02:45,963
On Unix systems, the proxy actually
attempts to mlock two the memory holding that

44
00:02:46,020 --> 00:02:48,443
header so it is not swapped to disk.

45
00:02:48,656 --> 00:02:51,723
It literally locks the key into physical
RAM.

46
00:02:51,903 --> 00:02:58,123
And then, they use the zeroize crate in
Rust to completely wipe the stack buffers as

47
00:02:58,155 --> 00:02:59,403
soon as it is processed.

48
00:02:59,856 --> 00:03:02,256
Wow, mlock two.

49
00:03:02,856 --> 00:03:05,736
That is serious low level system
hardening.

50
00:03:06,276 --> 00:03:11,677
So it is locked in RAM, it never hits the
swap space, and the temporary buffers are

51
00:03:11,837 --> 00:03:12,716
zeroed out.

52
00:03:13,476 --> 00:03:17,956
But, okay, once the proxy is running with
that key safely locked away,

53
00:03:18,556 --> 00:03:20,636
how do other developers actually use it?

54
00:03:20,958 --> 00:03:25,038
So, the proxy binds to a local loopback
address, like, say,

55
00:03:25,098 --> 00:03:30,638
one hundred and twenty seven point zero
point zero point one on port sixty thousand

56
00:03:30,778 --> 00:03:31,438
one.

57
00:03:31,598 --> 00:03:37,918
And it exposes exactly one route, POST
slash v1 slash responses.

58
00:03:38,046 --> 00:03:39,038
That is it.

59
00:03:39,198 --> 00:03:44,878
If someone tries to hit any other path, or
uses a different H T T P method,

60
00:03:44,931 --> 00:03:50,158
or tries query string manipulation, the
proxy just hits them with a swift four

61
00:03:50,208 --> 00:03:52,158
hundred and three Forbidden.

62
00:03:52,371 --> 00:03:57,358
So unprivileged users can send prompts to
that local port, they get their Codex

63
00:03:57,438 --> 00:04:02,078
responses, but they never, ever get to see
the actual raw key.

64
00:04:02,402 --> 00:04:03,682
Okay, I see.

65
00:04:04,303 --> 00:04:09,023
So a system administrator or a privileged
service account spins up the proxy,

66
00:04:09,442 --> 00:04:13,682
feeds it the key, and then the developers
just talk to the local loopback port.

67
00:04:14,562 --> 00:04:17,282
But, how do you actually set that up in
practice?

68
00:04:17,762 --> 00:04:18,822
What does the command look like?

69
00:04:19,208 --> 00:04:24,088
Yeah, so you would run something like
printenv with the OpenAI key,

70
00:04:24,136 --> 00:04:30,568
pipe that directly into codex responses
api proxy, and you use the env u tool to

71
00:04:30,600 --> 00:04:32,968
make sure it is stripped from the
execution scope.

72
00:04:33,148 --> 00:04:39,928
And you can pass in flags like dash dash
http shutdown and dash dash server

73
00:04:40,056 --> 00:04:46,408
info pointing to a temp file, say, slash
tmp slash server info dot json.

74
00:04:46,588 --> 00:04:51,448
The proxy then boots up, grabs the key,
clears the environment,

75
00:04:51,488 --> 00:04:55,448
and writes its port and its process ID
into that JSON file.

76
00:04:55,857 --> 00:05:01,677
Okay, so the port is written to slash tmp
slash server info dot json.

77
00:05:02,217 --> 00:05:07,497
Then as an unprivileged user, I can just
use jq to extract that port,

78
00:05:07,537 --> 00:05:09,597
and then I put it in my local
configuration.

79
00:05:10,157 --> 00:05:15,638
Like, in my config dot toml, under my
custom provider, I would set wire api equals

80
00:05:15,697 --> 00:05:20,138
responses, and then I just launch Codex
with dash p proxy.

81
00:05:20,197 --> 00:05:21,517
It is super seamless.

82
00:05:22,074 --> 00:05:22,774
It is!

83
00:05:23,194 --> 00:05:27,254
But, uh, we have to talk about a pretty
significant catch with that setup.

84
00:05:27,934 --> 00:05:31,554
That dash dash http shutdown flag I
mentioned?

85
00:05:32,255 --> 00:05:38,114
It is designed so that a script can send a
GET request to slash shutdown when a job

86
00:05:38,174 --> 00:05:39,074
is done, right?

87
00:05:39,534 --> 00:05:40,414
To clean things up.

88
00:05:41,114 --> 00:05:44,834
But on a shared box, since anyone can
access the loopback port,

89
00:05:45,454 --> 00:05:50,774
any unprivileged user can send that
shutdown request and kill the proxy for everyone

90
00:05:50,834 --> 00:05:51,034
else.

91
00:05:51,462 --> 00:05:52,342
Oh, no.

92
00:05:52,782 --> 00:05:58,543
So, one developer finishes their script,
hits shutdown, and suddenly everyone else's

93
00:05:58,682 --> 00:06:01,522
active development sessions get completely
cut off.

94
00:06:02,022 --> 00:06:03,463
That is a massive headache.

95
00:06:03,750 --> 00:06:04,950
Exactly.

96
00:06:04,977 --> 00:06:10,150
So, if you are running this in a true
multi user setup, you definitely want to omit

97
00:06:10,198 --> 00:06:12,230
that http shutdown flag.

98
00:06:12,370 --> 00:06:17,270
You are much better off managing the proxy
lifecycle through something like systemd

99
00:06:17,457 --> 00:06:21,430
or a proper orchestrator that only
privileged users can touch.

100
00:06:21,736 --> 00:06:22,496
That makes sense.

101
00:06:22,856 --> 00:06:25,137
Keep the shutdown controls locked down.

102
00:06:25,877 --> 00:06:30,156
Now, besides this proxy, I saw there are
some other really nice quality of life

103
00:06:30,217 --> 00:06:31,936
updates in this same release cycle.

104
00:06:32,208 --> 00:06:32,768
Oh, yeah!

105
00:06:32,848 --> 00:06:38,048
They upgraded the local search engine to
ripgrep version fifteen point two point

106
00:06:38,096 --> 00:06:38,448
zero.

107
00:06:38,592 --> 00:06:41,808
That speeds up workspace analysis
significantly.

108
00:06:41,936 --> 00:06:46,848
They also optimized the terminal UI
markdown engine, which means when you are

109
00:06:46,896 --> 00:06:51,248
streaming long code responses, you do not
get that annoying stutter on the screen

110
00:06:51,298 --> 00:06:51,728
anymore.

111
00:06:51,915 --> 00:06:53,888
It is just buttery smooth.

112
00:06:54,794 --> 00:06:55,674
I love that.

113
00:06:56,055 --> 00:07:00,034
And they even added animated reasoning
indicators in the T U I,

114
00:07:00,434 --> 00:07:05,275
so you can actually see when the model
shifts gears into high compute effort levels,

115
00:07:05,554 --> 00:07:07,014
like Max or Ultra.

116
00:07:07,634 --> 00:07:11,354
It is the little things that make the
terminal feel alive.

117
00:07:11,967 --> 00:07:12,887
It really is.

118
00:07:13,467 --> 00:07:15,567
Well, that is a wrap on this security
dive.

119
00:07:15,907 --> 00:07:16,827
Good chatting, Maya.

120
00:07:17,548 --> 00:07:18,688
Yeah, talk soon!