We eliminated 1,400 CVEs in NanoClaw's container images
1–10 of 54 posts
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#2so s/bookworm/trixie/g didn't work then?
Yes, this is mostly a joke, I am able to understand the difference between base distros.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#3Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#4Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
If the thing measuring whether there are CVEs is also the thing creating said CVEs, are we sure they are even CVEs? Deduped? Etc.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#5Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
[deleted]
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#6I don't understand the 'custom patch' strategy over 'fix the app with a major version change' strategy.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#7Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
[deleted]
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#8Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today:
Unhardened: docker.io/nanoco/nanoclaw:agent-alpha
71 packages, 344 unique CVEs, linux/arm64
PACKAGE VERSION TYP C H M L N TOT
-----------------------------------------------------------
expat 2.5.0 deb 0 4 18 1 2 25
curl 7.88.1 deb 4 4 6 0 7 21
hono 4.12.14 npm 0 1 18 2 0 21
libtiff 4.5.0 deb 0 2 1 1 15 20
perl 5.36.0 deb 5 6 3 0 3 17
pnpm 10.33.0 npm 0 8 7 0 0 15
glibc 2.36 deb 1 2 2 1 7 13
openjpeg 2.5.0 deb 0 0 3 1 9 13
cups 2.4.2 deb 0 2 8 0 1 11
glib2 2.74.6 deb 1 7 1 0 1 10
tar 1.34(+2) deb 1 1 7 0 1 10
llvm 15.0.6 deb 0 0 0 1 9 10
sqlite3 3.40.1 deb 1 2 3 0 3 9
nss 3.87.1 deb 1 0 3 0 4 8
avahi 0.8 deb 0 0 8 0 0 8
util-linux 2.38.1 deb 0 0 3 0 2 7
elf 0.188 deb 0 0 0 0 7 7
libssh2 1.10.0 deb 1 4 1 0 0 6
openldap 2.5.13 deb 0 1 0 0 5 6
chromium 151.0.7922.108 deb 0 5 0 0 0 5
-----------------------------------------------------------
UNIQUE CVEs 16 68 121 17 119 344
(+51 more packages, 102 findings)
C/H/M/L/N = critical/high/medium/low/negligible.
Counts are unique CVEs: binaries from one source package are
grouped (libcurl4 + libcurl3-gnutls + curl = curl), so a CVE
hitting three of them counts once, not three times.Re: We eliminated 1,400 CVEs in NanoClaw's container images
#9I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#10I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
This is how Vanta et al. make millions.