Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nvidia NemoClaw

github.com

Post reply on HN
Print view View original

131–140 of 291 posts

Re: Nvidia NemoClaw

#131

Post by cyanydeez »

empiricus wrote: post #67
Netcob wrote: post #65

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other servic…

you put the dog in crate with a COPY of your documents.

Your dog has now ordered a hitman to kill you, assume your identity and to live vacariously as a simple bartender at Cheers.

Re: Nvidia NemoClaw

#132

Post by _zoltan_ »

mjr00 wrote: post #86
chill_ai_guy wrote: post #74

Earlier quoted context omitted.

Lol you think these github repos just materialize as is? They probably did all the iteration and development internally and then ported it over to a github repo and made it public afterwards

No they didn't. You can see all the commits as this was built iteratively[0]. This project started development on Saturday morning and now it's here. This is pretty common now, people love to rapidly throw together stuff and show it off a few days later. The only thing different about this from your average Show HN sloppa is that it's living under the NVIDIA Github org, though that also has 700+ repositories[1] in it…

it's the new norm that you put together stuff, it works and you show it off.

all the naysayers, "senior" engineers who haven't done any assisted coding by Claude/codex, just need to get either with the program or it's time to retire, as this is just the beginning.

if you can't ship stuff in days then I have some bad news for you.

Re: Nvidia NemoClaw

#133

Post by observationist »

Netcob wrote: post #65

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other servic…

What makes it even better is that these dogs are like Malinois. If they want to get into something, they will; people have had their entire network compromised by bots they left running overnight, and any important information like account logins and so on runs the risk of being misused.

It's one thing to sandbox, maybe give the bot a temporary, limited $100 card or account to go perform a specific task, but there's no coherent mind underlying these agents.

Depending on how the chain of thought / reasoning goes, or what text they get exposed to on the internet, it could tap into spy novel, hacker fanfic, erotic fiction, or some weird reddit rabbithole and go completely off the rails in ways that you'll never be able to guard against, audit, or account for.

Claw bots seem to be a weird sort of alternate reality RPG more than a useful tool, so far. If you limit it to verifiable tasks, it might be safer, but I keep seeing people rave about "leaving it on overnight and waking up to a finished project" and so on. Well sure, but it could also hack your home network, delete your family pictures folder, log into your bank account and wire all your money to shrimp charities.

Might be wise to wait on safer iterations of these products, I think.

Re: Nvidia NemoClaw

#134

Post by coppsilgold »

Using bespoke sandboxing seems rather pointless, it will be brittle in ways you aren't going to be familiar with unless you spend time studying the bespoke method. Brittle as in it might break a workflow and you wouldn't know why, or give it permissions you don't understand.

It's better to just study a general sandbox method once and use that.

> Sandbox my-assistant (Landlock + seccomp + netns)

Might as well just use a custom bwrap/bubblewrap command to isolate the agent to its own directory - it will leave wide swaths of the kernel exposed to 0day attacks.

The simplest sandbox method you can use is to just use docker with the runsc runtime (gVisor). And it also happens to be among the most secure methods you are going to find. You can also run runsc(gVisor) manually with a crafted OCI json, or use the `do` subcommand with an EROFS image.

Trying to selectively restrict networking is not something I usually bother with, unless you make it iron-clad it would likely give you a false sense of security. For example Nemoclaw does this by default: https://docs.nvidia.com/nemoclaw/latest/reference/network-po...>

github.com and api.telegram.org will trivially facilitate exfiltration of data. Some others will also allow that by changing an API key I imagine.

Re: Nvidia NemoClaw

#135

Post by angry_octet »

hardsnow wrote: post #100
hmokiguess wrote: post #84

Earlier quoted context omitted.

Yes, although what I think is different in this setup here is the OpenShell gateway override, as they mention: > NemoClaw installs the NVIDIA OpenShell runtime and Nemotron models, then uses a versioned blueprint to create a sandboxed environment where every network request, file access, and inference call is governed by declarative policy. The nemoclaw CLI orchestrates the full stack: OpenShell gateway, sandbox, inf…

OpenShell is the gem here indeed. A lot of good ideas like network sandbox that does TLS decryption and use of policy engine to set the rules. However: > Credentials never leak into the sandbox filesystem; they are injected as environment variables at runtime. If anyone from the team is reading - you should copy surrogate credentials approach from here to secure the credentials further: https://github.com/airutorg/ai…

The LLM will easily leak these credentials out. So the creds should be outside the sandbox, and the only thing the sandbox should see is a connection API that opens a socket/file handle.

Alternatively where is needs an API key, it should be one bound to the endpoint using it. E.g. a ticket granting ticket is used to create a bound ticket.

A copy on write filesystem would be an interesting way to sandbox writes, but there is difficulty in checking the diff.

Re: Nvidia NemoClaw

#136

Post by tgtweak »

I think the more useful tool would be an LLM prompt proxy/firewall that puts meaningful boundaries in place to prevent both exfiltration of sensitive data and instructions that can be destructive. Using the same context loop for your conversational/coding workflow makes the task at hand and the security of that task very hard to differentiate.

Sending POST?DEL requests? risky. Sending context back to a cloud LLM with credentials and private information? risky. Running RM commands or commands that can remove things? risky, running scripts that have commands in them that can remove things? risky.

I don't know how we've landed on 4 options for controls and are happy with this: "ask me for everything", "allow read only", "allow writes" and "allow everything".

Seems like what we need is more granular and context-aware controls rather than yet another box to put openclaw in with zero additional changes.

Re: Nvidia NemoClaw

#138

Post by rune-dev »

ttsalami wrote: post #39
bigfishrunning wrote: post #22

Earlier quoted context omitted.

> OpenClaw lets people live a bit dangerously, but fundamentally gives them something that they actually wanted. They wanted it so badly that they're willing to take what seem like insane risks to get it. For the first time in my career I feel so incredibly behind on this: What is open claw giving people that they want so badly? It just seems like Russian Roulette, I honestly don't see the upside

I can give you, as an example, what is driving me towards trying it. I work as a contractor for 2 companies, not out of necessity, but greed. I also have a personal project with a friend that is dangerously close to becoming a business that needs attention. I also have other responsibilities and believe it or not - friends. Also the ADHD on top of that. I yearn for a personal assistant. Something or somebody that wil…

But isn’t this just another notification to ignore?

The ticket being assigned to you is your “Hey take care of this!” ping, same with the email or text from your friend.

How long until you start tuning out the openclaw notifications?

Re: Nvidia NemoClaw

#139

Post by aprdm »

CrzyLngPwd wrote: post #111

Gotta say, that I feel kind of sad for the people that feel the need for these claw things. Are they so busy with their lives that they need an assistant, or do they waste their lives speaking to it like it is a human, and then doomscrolling on some addictive site instead of attending to their lives in the real world?

Do you feel sad for people who use a computer or a cellphone or file taxes online instead of paper ? How is this any different ?

I use those tools to make my life easier/faster

Re: Nvidia NemoClaw

#140

Post by angry_octet »

hector_vasquez wrote: post #109
Netcob wrote: post #65

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other servic…

> Am I missing something? You are indeed missing a TON. A lot of Open Claw users don't give it everything. We give it specific access to a group of things it needs to do the things we want. If I want an agent to sit there 24/7 maximizing uptime of my service, I give it access to certain data, the GitHub repo with PR privileges, and maybe even permissions to restart the service. All of this has to be very thoughtful a…

The problem is boundary enforcement fatigue. People become lazy, creating tight permission scopes is tedious work. People will use an LLM to manage the scopes given to another LLM, and so on.
Post reply on HN