Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Clawdbot - open source personal AI assistant

github.com

Post reply on HN
Print view View original

101–110 of 274 posts

Re: Clawdbot - open source personal AI assistant

#101

Post by Mic92 »

xtagon wrote: post #95

Wild. There are 300 open Github issues. One of them is this (also AI generated) security report: https://github.com/clawdbot/clawdbot/issues/1796 claiming findings of hundreds of high-risk issues, including examples of hard coded, unencrypted OAuth credentials. I am...disinclined to install this software.

I skipped over the first few ones and haven't seen critical ones. The hardcoded oauth client secrets is basically present in any open-source or commercial app that is distributed to end users. It doesn't break the security of end users. It mainly allows other apps to impersonate this app, i.e. present itself as clawdbot, which is a moot point given anyone can just change /inject code into it.

Re: Clawdbot - open source personal AI assistant

#102

Post by apetresc »

BoorishBears wrote: post #82
apetresc wrote: post #46

Earlier quoted context omitted.

I have an old iPhone with a broken screen that I threw an $8/month eSIM onto so that it has its own phone number, that I just keep plugged in with the screen off, on Wifi, in a drawer. It hosts a number of things for me, most importantly bridges for WhatsApp and iMessage. So I can actually give things like Clawdbot their own phone number, their own AppleID, etc. Then I just add them as a contact on my real phone, and…

I heard it costs $15 for just a few minutes of usage though

The phone plan or Clawdbot?

Re: Clawdbot - open source personal AI assistant

#103

Post by cmorgan31 »

strangescript wrote: post #100
xtagon wrote: post #95

Wild. There are 300 open Github issues. One of them is this (also AI generated) security report: https://github.com/clawdbot/clawdbot/issues/1796 claiming findings of hundreds of high-risk issues, including examples of hard coded, unencrypted OAuth credentials. I am...disinclined to install this software.

If you read the PR, the bad issues are in a few extensions, not the bot itself. The unencrypted oAuth token isn't really a big deal. It should be fixed but its a "if this box is compromised" type thing. Given the nature of clawdbot, you are probably throwing it on a random computer/vps you don't really care about (I hope) without access to anything critical.

You know, as the rest of us do, that someone has already thrown it loose in the same place where they store their banking information. Oh well, lessons will be learned about containers.

Re: Clawdbot - open source personal AI assistant

#104

Post by hahahahalolhw »

jason_tko wrote: post #92
kristopolous wrote: post #85

Earlier quoted context omitted.

This is a thing you can enable on GitHub for any project. You just described a GitHub feature

https://news.ycombinator.com/item?id=9224

How adorable, what a self-own.

First those are completely different sentiments. One is a feature built into the product in question the other is a hodgepodge of shit.

Second, and most importantly, Dropbox may as well not exist anymore. It’s a dead end product without direction. Because, and this is true, it was barely better than the hodgepodge of shit AND they ruined that. Literally everything can do what Dropbox does and do it better now.

But keep posting that; it’s your one hit wonder.

Re: Clawdbot - open source personal AI assistant

#105

Post by xtagon »

strangescript wrote: post #100
xtagon wrote: post #95

Wild. There are 300 open Github issues. One of them is this (also AI generated) security report: https://github.com/clawdbot/clawdbot/issues/1796 claiming findings of hundreds of high-risk issues, including examples of hard coded, unencrypted OAuth credentials. I am...disinclined to install this software.

If you read the PR, the bad issues are in a few extensions, not the bot itself. The unencrypted oAuth token isn't really a big deal. It should be fixed but its a "if this box is compromised" type thing. Given the nature of clawdbot, you are probably throwing it on a random computer/vps you don't really care about (I hope) without access to anything critical.

You're talking about if a box is compromised, but to clarify, this is hard coded into the source in the repo, not an end-user's credentials (and it's a `client_id` and `client_secret`, not a token): https://github.com/clawdbot/clawdbot/blob/7187c3d06765c9d3a7...

Re: Clawdbot - open source personal AI assistant

#107

Post by eclipxe »

pylotlight wrote: post #98
apetresc wrote: post #10

I found this HN post because I have a Clawdbot task that scans HN periodically for data gathering purposes and it saw a post about itself and it got excited and decided to WhatsApp me about it. So that’s where I’m at with Clawdbot.

Do you tell it what you find interesting so it only responds with those posts? i.e AI/tech news/updates, gaming etc..

Yes. And I rate the suggestions it gives me and it then stores to memory and uses that to find better recommendations. It also connected dots from previous conversations we had about interests and surfaced relevant HN threads

Re: Clawdbot - open source personal AI assistant

#108

Post by eclipxe »

anotherengineer wrote: post #36
apetresc wrote: post #10

I found this HN post because I have a Clawdbot task that scans HN periodically for data gathering purposes and it saw a post about itself and it got excited and decided to WhatsApp me about it. So that’s where I’m at with Clawdbot.

how do you have Clawdbot WhatsApp you? i set mine up with my own WhatsApp account, and the responses come back as myself so i haven't been able to get notifications

Telegram setup is really nice

Re: Clawdbot - open source personal AI assistant

#109

Post by eclipxe »

thehamkercat wrote: post #53
maximilianroos wrote: post #49

Earlier quoted context omitted.

He explicitly disavowed any crypto / coin endorsement (I don't _love_ his vibes on Twitter, but he seems like a very reasonable guy generally, and the project seems awesome)

The project is okay but i don't understand the crazy hype

It took me a few tries but once I got a good setup going I started finding all sorts of little things throughout my day I could throw over to it and it would just do it and figure it out. I was then hooked.

Re: Clawdbot - open source personal AI assistant

#110

Post by gdiamos »

It sounds like lack of security is the biggest feature and risk of this clawd thing.

I also tried using Siri to tell me the weather forcast while I was driving to the park. It asked me to auth into my phone. Then it asked me to approve location access. I guess it was secure but I never figured out what the weather forecast was.

Thankfully it didn't rain on my picnic. Some of the parents there asked me if their investors should be interested in clawd.

Post reply on HN