Hacker News

points by komali2 2 days ago | 0 comments

If you let the LLM see git commands, they have whatever email you use to sign commits.

I use a masked email for Git too. Always have. Last 5 years or so it's just been the GitHub provided mask e.g. <numeric-ID>+<username>@users.noreply.github.com

[–] soraminazuki 4 hours ago

That won't save you in this case because that email address still identifies you. It's an anti-spam measure, not a privacy measure.

[–] j45 2 days ago

Masked email or separate email is the way.

[–] toomuchtodo 2 days ago

I am a security person, I don’t let the LLM see anything except that which I wouldn’t mind printed on the front page of the New York Times. I treat my LLM context as I would a potentially malicious threat actor. Nothing valuable, sensitive, or personal goes into the context.

“lethal trifecta”

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

(a component of my cybersecurity work is red teaming inference, agents, and mcp interfaces)