Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
It’s like it’s made of CVEs. First 50-100 should be a good sign if it’s cleaner to start over.
We eliminated 1,400 CVEs in NanoClaw's container images
11–20 of 54 posts
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#12Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#13so s/bookworm/trixie/g didn't work then? Yes, this is mostly a joke, I am able to understand the difference between base distros.
a spot on "joke". deb12 is gone for a month now.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#14Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
It's the opposite of NIH syndrome. Need to left pad a string? Just import a library from some rando on the internet!
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#15Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today: Unhardened: docker.io/nanoco/nanoclaw:agent-alpha 71 packages, 344 unique CVEs, linux/arm64 PACKAGE VERSION TYP C H M L N TOT ----------------------------------------------------------- expat 2.5.0 deb 0 4 18 1 2 25 curl 7.88.1 deb 4 4 6 0 7 21 hono 4.12.14 npm 0 1 18 2 0 21 libtiff 4.5.0 de…
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#16Earlier quoted context omitted.
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today: Unhardened: docker.io/nanoco/nanoclaw:agent-alpha 71 packages, 344 unique CVEs, linux/arm64 PACKAGE VERSION TYP C H M L N TOT ----------------------------------------------------------- expat 2.5.0 deb 0 4 18 1 2 25 curl 7.88.1 deb 4 4 6 0 7 21 hono 4.12.14 npm 0 1 18 2 0 21 libtiff 4.5.0 de…
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
That’s not security, it’s compliance.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#17I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#18If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#19Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today: Unhardened: docker.io/nanoco/nanoclaw:agent-alpha 71 packages, 344 unique CVEs, linux/arm64 PACKAGE VERSION TYP C H M L N TOT ----------------------------------------------------------- expat 2.5.0 deb 0 4 18 1 2 25 curl 7.88.1 deb 4 4 6 0 7 21 hono 4.12.14 npm 0 1 18 2 0 21 libtiff 4.5.0 de…
[deleted]
Re: We eliminated 1,400 CVEs in NanoClaw's container images
#20Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
Hold my beer