What is NanoClaw? Glad you asked: > NanoClaw is a secure, lightweight alternative to OpenClaw.
I'm pretty skeptical you can call any claw-like thing secure unless you solve prompt injection.
We eliminated 1,400 CVEs in NanoClaw's container images
31–40 of 54 posts
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#32What is NanoClaw? Glad you asked: > NanoClaw is a secure, lightweight alternative to OpenClaw.
If the lightweight alternative has 1400 CVEs, how many does OpenClaw have?
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#33Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
Because it's written in Javascript and there are classes of highly-situational and not-especially-meaningful vulnerabilities that broadly impact the entire ecosystem ("prototype pollution" is the canonical example) that get counted individually in every occurrence in every NPM package.
It's not a real number, and, worse, it obscures the real figure of merit (/demerit). The Node ecosystem does have a real problem with its culture of sprawling dependencies. But it's not the first-order issue with this "1400" number.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#34What is NanoClaw? Glad you asked: > NanoClaw is a secure, lightweight alternative to OpenClaw.
I'm pretty skeptical you can call any claw-like thing secure unless you solve prompt injection.
Security isn't binary. There's nothing that's "secure" unless you define a threat model first.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#35Earlier quoted context omitted.
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
That’s not security, it’s compliance.
[deleted]
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#36I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.
Why is that even part of the image?
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#37Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
Because it's written by a type of dev that thinks everything should use JS because that's what they used for 6 months while working at a FAANG company before getting laid off and since they worked at a FAANG company clearly they know better than you so if you attack them for using an extremely poor language you just aren't a seriously person so please shut up while I go fishing for some VC funds.
It's like asking why Claude Code is written with react, because the devs getting paid >$500k a year clearly know better d'uh.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#38Earlier quoted context omitted.
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today: Unhardened: docker.io/nanoco/nanoclaw:agent-alpha 71 packages, 344 unique CVEs, linux/arm64 PACKAGE VERSION TYP C H M L N TOT ----------------------------------------------------------- expat 2.5.0 deb 0 4 18 1 2 25 curl 7.88.1 deb 4 4 6 0 7 21 hono 4.12.14 npm 0 1 18 2 0 21 libtiff 4.5.0 de…
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
Most modern scanners know the backported versions for the major vendors (ubuntu/debian/rhel/alpine), but it was definitely an issue a decade ago.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#39Earlier quoted context omitted.
I'm pretty skeptical you can call any claw-like thing secure unless you solve prompt injection.
Security isn't binary. There's nothing that's "secure" unless you define a threat model first.
Sounds like the kind of stuff devs that introduce security vulnerbilities say.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#40Earlier quoted context omitted.
Security isn't binary. There's nothing that's "secure" unless you define a threat model first.
Sounds like the kind of stuff devs that introduce security vulnerbilities say.
Unrelatedly, I wonder why I don't see the downvote arrows on comments any more.