Live data from Hacker News

OpenClaw is a security nightmare dressed up as a daydream

composio.dev

151–160 of 323 posts

Re: OpenClaw is a security nightmare dressed up as a daydream

#151

Not just OpenClaw. Anyone giving an LLM direct access to the system is completely irresponsible. You can't trust what it will do, because it has no understanding. But people don't give a shit, gotta go fast - even if they are going in a bad direction.

Well Google has activated access to Google drive, mail, etc for most users automatically (or maybe I just clicked yes sometime) and so far I think it's a net positive for me personally and don't here from any disasters publicly.

Re: OpenClaw is a security nightmare dressed up as a daydream

#152
I'm a heavy OpenClaw user and I've been testing it in many different scenarios — the profundity of what I can do with it now is crazy. It's literally automating my life. Being AuDHD, OpenClaw feels like a big relief. The positive sides are amazing. The downsides... well, as with any security and any LLM, they're all prone to the same problems discussed here. Having Claude Code on yolo mode exposes you to the exact same risks

Re: OpenClaw is a security nightmare dressed up as a daydream

#153

Not just OpenClaw. Anyone giving an LLM direct access to the system is completely irresponsible. You can't trust what it will do, because it has no understanding. But people don't give a shit, gotta go fast - even if they are going in a bad direction.

Agree on the LLM part. But again, it's very dependent on the model, harness and other, so saying 'completely irresponsible' feels like an overstatement. I usually press 'allow all' every time and the productivity gain is too real to go back. The risk is truly there, sure, but so is the risk of crossing the street

Re: OpenClaw is a security nightmare dressed up as a daydream

#154
My prediction is that OpenClaw will eventually die. But it has provided a small glimpse of the future.The way the average consumers interact with computers will drastically change.

I can envision someone sitting in a park bench with a small set of earphones planning a family trip with their AI. They get home and see the details of it on their fridge. They check with their partner, and then just tell the AI to book it. And it all works.

I probably won’t use it and hate it. I’ll stick to my old ways of booking the trip with my fingers. But those born into it will look at me crazy.

Re: OpenClaw is a security nightmare dressed up as a daydream

#155

> Separate Accounts for your OpenClaw > As I have mentioned, treat OpenClaw as a separate entity. So, give it its own Gmail account, Calendar, and every integration possible. And teach it to access its own email and other accounts. In addition, create a separate 1Password account to store credentials. It’s akin to having a personal assistant with a separate identity, rather than an automation tool. The whole point of…

There are plenty of ways to use openclaw that aren’t with your own data. You can use it with any kind of data.

Re: OpenClaw is a security nightmare dressed up as a daydream

#156
post #81

Earlier quoted context omitted.

I'm gonna keep saying this forever - there are two obvious "killer apps" for crypto: 1. Semi-private blockchains, where you can rely on an actor not to be actively malicious, but still want to be able to cryptographically hold them to a past statement (think banks settling up with each other) 2. NFTs for tracking physical products through a logistics supply chain. Every time a container moves from one node to the nex…

Not only do you not need the blockchain for either of those things, you don't want it. Think it through. How do you actually "cryptographically hold" someone to anything? You take them to court. Guess what you can do, right now, without the blockchain? That's right, you can take them to court. You're just reinventing normal contract law with extra steps. The cryptographic part doesn't even help you when you can just…

This exact thing happens too often. We try to use fancy technology to solve a non-texhnical problem.

With or without blockchain you end up at court. If you build a decentralized trust system, the builder of the system needs to be trusted. If you want to use decentralized trust to do your taxes or other government communication you still need to trust your government. These are all actual examples i’ve encountered.

You pretty much always end up at the legal system. If there js anything to make big impact on it would be that. But that requires world-wide revolution.

Re: OpenClaw is a security nightmare dressed up as a daydream

#157
post #81

Earlier quoted context omitted.

>There are real, impressive examples of the power of agentic flows there aren't, and just like the blockchain "industry" with its "surely this is going to be the killer app" we're going to be in this circus until the money dries up. Just like the note-taking craze, the crypto ecosystem and now AI there's an almost inverse relation between the people advocating it and actually doing any meaningful work. The more anyon…

I'm gonna keep saying this forever - there are two obvious "killer apps" for crypto: 1. Semi-private blockchains, where you can rely on an actor not to be actively malicious, but still want to be able to cryptographically hold them to a past statement (think banks settling up with each other) 2. NFTs for tracking physical products through a logistics supply chain. Every time a container moves from one node to the nex…

IMHO, most people misunderstand the real utility of crypto.

The thing to keep in mind is that replacing a database with computationally expensive crypto is sub-optimal. Supply Chain tracking falls into this category: why crypto over barcodes and a database?

Governments use Banks with their deterministic processes to manage and guarantee transactions. This is where crypto shines- replacing the entire banking system as an intermediary to manage and guarantee transactions. Crypto can do this better and cheaper than Banks.

There are other domains where the government is the backstop/guarantor and leverages intermediaries to manage the scale. Real Estate comes to mind. Identity is another. Crypto can be useful there.

One last useful crypto application is to replace governments themselves as the backstop and final/guarantor for transactions.

These are ideas that evoke strong reactions. There's a reason the inventor of crypto is anonymous, to this day.

Re: OpenClaw is a security nightmare dressed up as a daydream

#158
post #130
post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Booking a flight is the kind of thing I want to dedicate my full attention to. It's expensive, and the timing and details matter a lot. I'm happy for the voice assistant to add stuff to my grocery list, though. The consequences are not serious if it screws up a letter or something.

Booking a flight is the kind of thing I'd really want to avoid doing myself nowadays if possible though. Surveying the offers is usually such a snake pit of deceptive marketing and incomplete service conditions that I feel somewhat nauseous just at the prospect of having to look at it.

I wouldn't remotely trust a software assistant to deal with all that misdirection autonomously, but I guess I'd be prepared to give it a chance collating options with tolerable time and cost, attempting to make the price include the stuff that has to be added to preserve health, sanity and a modicum of human dignity.

Re: OpenClaw is a security nightmare dressed up as a daydream

#159
post #130
post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Booking a flight is the kind of thing I want to dedicate my full attention to. It's expensive, and the timing and details matter a lot. I'm happy for the voice assistant to add stuff to my grocery list, though. The consequences are not serious if it screws up a letter or something.

We will get to the point where you'll trust it to catch those issues. The latest models can already do it sometimes for code, like explain that it considered various options and the tradeoffs between them.

Re: OpenClaw is a security nightmare dressed up as a daydream

#160
post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

OpenClaw is just like any other tool, you need to learn it before its power is available to you. Just like anything in engineering really: you have to play around source control to understand source control, you have to play around with database indexes to learn how to optimize a database. Once you've learned it and incorporated it into your tool set, you then have that to wield in solving problems "oh, damn, a datab…

> OpenClaw is just like any other tool, you need to learn it before its power is available to you.

That's ridiculous. The utility of any tool is usually knowable before using it. That's how most tools work. I don't need to learn how to drive a car to know what I could use it for. I learn to drive it because I want to benefit from it, not the other way around.

It's the same with computers and any program. I use it to accomplish a specific task, not to discover the tasks it could be useful for.

OpenClaw is yet another tool in search of a problem, like most of the "AI" ecosystem. When the bubble bursts, nobody will remember these tools, and we'll be able to focus on technology that solves problems people actually have.

Post reply on HN