201–210 of 306 posts
Honest question: What do people actually USE OpenClaw for? The most common usage seems to be "it reads your emails!", that's the exact opposite of "exciting"...
I was asked by someone recently to try to set up an OpenClaw that would search for ordinances and other land registry information for all 3000+ counties/parishes in the USA to obtain and distill specific details on their support for building tiny homes.
OpenClaw creator here. This was a privilege-escalation bug, but not "any random Telegram/Discord message can instantly own every OpenClaw instance." The root issue was an incomplete fix. The earlier advisory hardened the gateway RPC path for device approvals by passing the caller's scopes into the core approval check. But the `/pair approve` plugin command path still called the same approval function without `callerS…
Can you speak a little bit more to the stats in the OP? * 135k+ OpenClaw instances are publicly exposed * 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can request pairing access and start the exploit chain Is this accurate? This is definitely a very different picture then the one you paint
I don't use OpenClaw, but I still run my Claude Code and Codex as limited macOS user accounts and just have a script `become-agent [cmd ...]` that does some sudo stuff to run as the limited user so they don't have any of my environment or directory access, or really any system-level admin access at all. They can use and write to their home directories as usual, which makes things easier to configure since those CLI h…
I do disagree about unix system were designed for this kind of stuff. Unix was not designed for an agent to act like you and take decision for you...
OpenClaw has over 400+ security issues and vulnerabilities. [0] Why on earth would you install something like that has access to your entire machine, even if it is a separate one which has the potential to scan local networks? Who is even making money out of OpenClaw other than the people attempting to host it? I see little use out of it other than a way to get yourself hacked by anyone. [0] https://github.com/opencl…
The root issue is that OpenClaw is 500K+ lines of vibe coded bloat that's impossible to reason about or understand. Too much focus on shipping features, not enough attention to stability and security. As the code base grows exponentially, so does the security vulnerability surface.
There are like 10 openclaw clones out there. If you prefer security over features, just pick up another one.
Earlier quoted context omitted.
I was asked by someone recently to try to set up an OpenClaw that would search for ordinances and other land registry information for all 3000+ counties/parishes in the USA to obtain and distill specific details on their support for building tiny homes.
What is OpenClaw doing here that Claude Desktop or Claude Code couldn't do?
I'd also instantly hit Claude Desktop's rate limits with this I reckon. Since Claw uses APIs, you bypass those limits and can route the messy scraping to cheap models, saving expensive ones for the actual analysis. It also handles Playwright integration and state persistence out of the box so a crash doesn't wipe your progress.
If I'm wrong, I'm open to learning. I'm as new to this as everyone :)
The Ludditism in this thread, and the linked thread, is shocking.
The root issue is that OpenClaw is 500K+ lines of vibe coded bloat that's impossible to reason about or understand. Too much focus on shipping features, not enough attention to stability and security. As the code base grows exponentially, so does the security vulnerability surface.
The current OpenClaw GitHub repo [1] contains 2.1 million lines of code, according to cloc, with 1.6M being typescript. It also has almost 26K commits. [1] https://github.com/openclaw/openclaw
But coding is solved? Why do you need those guys if all they do is use claude code? Just have it solve it overnight. You forgot to prompt "make it secure pls"?