Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw privilege escalation vulnerability

nvd.nist.gov

Post reply on HN
Print view View original

91–100 of 306 posts

Re: OpenClaw privilege escalation vulnerability

#91

Post by Sohcahtoa82 »

WhrRTheBaboons wrote: post #83
gruez wrote: post #78

Earlier quoted context omitted.

No? The comment was admittedly ambiguous but if you go to repo it's far clearer: >I use it to give me a weekly digest of what happened in my neighborhood and if there are any public hearings or trash pickups I might want to attend.

that does not seem like something you need an 'autonomous' agent for.

What would you propose as an alternative?

Anything not relying on an LLM likely means having to write bespoke scripts. That's not really worth the time, especially when you want summaries and not having to skim things yourself.

Going from doing it manually on a regular basis to an autonomous agent turns a frequent 5-15 minute task into a 30 second one.

Re: OpenClaw privilege escalation vulnerability

#92

Post by earnesti »

sunaookami wrote: post #50

Honest question: What do people actually USE OpenClaw for? The most common usage seems to be "it reads your emails!", that's the exact opposite of "exciting"...

I use it for a side project. I just put it on VPS, and then it edits the code and tests it. The nice thing is that I can use it on the go whenever I have spare moment. It is addictive, but way better addiction than social media IMO.

The thing where you give it access to all your personal data and whatever I haven't done and wouldn't do.

Re: OpenClaw privilege escalation vulnerability

#93

Post by butlike »

WhrRTheBaboons wrote: post #83
gruez wrote: post #78

Earlier quoted context omitted.

No? The comment was admittedly ambiguous but if you go to repo it's far clearer: >I use it to give me a weekly digest of what happened in my neighborhood and if there are any public hearings or trash pickups I might want to attend.

that does not seem like something you need an 'autonomous' agent for.

They've created a public bulletin board for themselves, like a café's blackboard, or a city telephone pole.

Re: OpenClaw privilege escalation vulnerability

#94

Post by williamstein »

machinecontrol wrote: post #71

The root issue is that OpenClaw is 500K+ lines of vibe coded bloat that's impossible to reason about or understand. Too much focus on shipping features, not enough attention to stability and security. As the code base grows exponentially, so does the security vulnerability surface.

The current OpenClaw GitHub repo [1] contains 2.1 million lines of code, according to cloc, with 1.6M being typescript. It also has almost 26K commits.

[1] https://github.com/openclaw/openclaw

Re: OpenClaw privilege escalation vulnerability

#96

Post by pezo1919 »

neya wrote: post #47
dang wrote: post #179

[stub for offtopicness and general piling-on behavior, which we don't want on this site] [[attacking project creators when they show up to discuss their work is particularly harmful; please don't ever do that here]] [[[if you posted any of these, we'd appreciate it if you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules from now on]]]

[flagged]

“It’s OK to be hacked until everyone is getting hacked.”

Re: OpenClaw privilege escalation vulnerability

#97

Post by mvdtnz »

Sohcahtoa82 wrote: post #91
WhrRTheBaboons wrote: post #83

Earlier quoted context omitted.

that does not seem like something you need an 'autonomous' agent for.

What would you propose as an alternative? Anything not relying on an LLM likely means having to write bespoke scripts. That's not really worth the time, especially when you want summaries and not having to skim things yourself. Going from doing it manually on a regular basis to an autonomous agent turns a frequent 5-15 minute task into a 30 second one.

> Anything not relying on an LLM likely means having to write bespoke scripts.

The very first line in your readme is "CivicClaw is a set of scripts and prompts" though? And almost the entire repo is a bunch of python scripts under a /scripts folder.

I looked at one randomly chosen script (scripts/sf_rec_park.py) and it's 549 lines of Python to fetch and summarise data that is available on an RSS feed ( https://sanfrancisco.granicus.com/ViewPublisher.php?view_id=... )

Re: OpenClaw privilege escalation vulnerability

#98

Post by butlike »

Leomuck wrote: post #43

Well, such things were to be expected. It's easy to bash on all the people who haven't gotten the necessary IT understanding of securing such things. Of course, it's uber-dumb to run an unprotected instance. But at the same time, it's also quite cool that so many people can do interesting IT stuff now. I'm thinking basically it's a trade-off. Be able to do great stuff, live with the consequences of doing that without…

With your car example, you also assume the risk unto others. If your "chopper" of a car hits and kills someone else, and you survive, you're paying for the consequences of that. I don't think it's cool that untrained people can do interesting IT stuff now. I see it as a huge liability where some unsecured instance pwns the internet, then it's some 12 year old that gets marched in front of congress and everyone goes: "wtf?" There's essentially no accountability and the damage is still done.

Re: OpenClaw privilege escalation vulnerability

#99

Post by earnesti »

machinecontrol wrote: post #71

The root issue is that OpenClaw is 500K+ lines of vibe coded bloat that's impossible to reason about or understand. Too much focus on shipping features, not enough attention to stability and security. As the code base grows exponentially, so does the security vulnerability surface.

There are like 10 openclaw clones out there. If you prefer security over features, just pick up another one.

Re: OpenClaw privilege escalation vulnerability

#100

Post by butlike »

fraywing wrote: post #29
nickthegreek wrote: post #22

Earlier quoted context omitted.

It does not need access to your full machine. It can literally run in a vps.

How do you think the vibe-coding layman audience is using OpenClaw?

"All you have to do is run the command `/yolo` to start your instance of OpenClaw."

/s

Post reply on HN