Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw is a security nightmare dressed up as a daydream

composio.dev

Post reply on HN
Print view View original

171–180 of 323 posts

Re: OpenClaw is a security nightmare dressed up as a daydream

#171

Post by phil21 »

mstkllah wrote: post #11
vessenes wrote: post #6

Yes, yes it is. And it's amaaaazing. We're going to have lots of sharp edges getting stuff like this secured, but it is not going to go away. Too useful.

What are your uses for it? If you don't mind sharing.

For me, personal home IT “chores” that I’ve put off for years. I can do them, but god what a pain in the ass to spin up a VM, configure Prometheus, configure grafana, configure a bunch of collectors for my WiFi and network infrastructure, and then spend a night or three tweaking dashboards and re-learning promql or whatever.

I just end up never doing it. Got it done in a couple hours with openclaw.

I’m sure there are much better ways to do that, which I will now learn in time due to the initial activation energy being broken on the topic. But for now, it’s fun running down my half decade old todo list.

Re: OpenClaw is a security nightmare dressed up as a daydream

#172

Post by mandeepj »

Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

> booking a flight

> Doing this manually is already pretty trivial

No, it’s not! You are the one who made it trivial by using three words to define! How about if I could only fly out between 9 am-noon next Friday? Also, combine it with hotel and rental car. Many times total $ between sites could be a difference of close to $200 or more along with better itinerary. That’s just the surface. The more preferences you add, the complex it becomes, so make it a right scenario for agent automation along with calendar management which has similar complexity.

Re: OpenClaw is a security nightmare dressed up as a daydream

#173

Post by ericd »

davidw wrote: post #130
Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Booking a flight is the kind of thing I want to dedicate my full attention to. It's expensive, and the timing and details matter a lot. I'm happy for the voice assistant to add stuff to my grocery list, though. The consequences are not serious if it screws up a letter or something.

Apparently I'm the only one here who finds it to be one of the worst things I ever have to do, I hate managing the combinatorial tab explosion by hand. Compounded by the adversarial nature of the price-setting algorithms that jack up the price on you if you show too much interest by researching too intensively. Just booked a flight for our family in two parts, and booking for one set of us made the price for the second set of us with a slightly different itinerary massively more expensive, because it was "in demand".

Can't wait for agents to handle all of it.

Re: OpenClaw is a security nightmare dressed up as a daydream

#174

Post by gos9 »

feznyng wrote: post #121
gos9 wrote: post #64

Earlier quoted context omitted.

No security problems carries a lot of weight here because by design you’re having to expose a significant amount of information but this is doable as a weekend project

How? There's a bunch of annoying problems here: - Where do you source real time traffic data, ferry schedules, etc? Google APIs get you part of the way there but you'd need to crawl public transit sites for the rest. - How do you keep track of what went into the fridge, what was consumed/thrown away? - How do you track real world events like buying a physical pass?

Feeding everything into a secure local environment with intelligence injected and then push things to your phone.

Oh wait. That might be a little insecure!

Hmm.

Re: OpenClaw is a security nightmare dressed up as a daydream

#175

Post by cassepipe »

brightball wrote: post #140
mjr00 wrote: post #44

Earlier quoted context omitted.

> why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. This AI wave is filled with "ideas guys/gals" who thought they had an amazing awesome idea and if only they knew how to program they could make a best-selling billion dollar idea, being confronted with the reality that their ideas are really uninteresting as well. They're still happy to…

Wait til you see my todo app though…

Can it suggest me to do the things I should do ? Can it talk to me into overcoming what's blocking me from completing tasks at an emotional level ? :)

Re: OpenClaw is a security nightmare dressed up as a daydream

#176

Post by array_key_first »

oatmeal1 wrote: post #169
array_key_first wrote: post #137

Earlier quoted context omitted.

They really didn't fall short. A lot of people who would've had assistants no longer do, now it's really just the executives like you said. But fairly low managers used to have them and now they don't. Software is pretty good. It remembers everything, perfectly, forever. It will never forget to remind you of something. It can give you directions, sort your emails by how important they are, help you find shops and res…

> It will never forget to remind you of something. Software isn't as faultless as you suggest. The default alarm app on my phone occasionally fails to go off (not an issue with Silent Mode or DND). > The only people busy enough to warrant an actual human doing that stuff are executives. Life is short. It is absolutely worthwhile to spend as little time doing trivial work if possible, and avoid decision fatigue on uni…

> Software isn't as faultless as you suggest. The default alarm app on my phone occasionally fails to go off (not an issue with Silent Mode or DND).

I'm guessing this is an iPhone, and yeah it's because that software is just bad. I've helped my Mom try to get her phone to ring, like, 12 times now and I've failed each time. And I'm a dev! So, point taken.

> Life is short. It is absolutely worthwhile to spend as little time doing trivial work if possible, and avoid decision fatigue on unimportant decisions.

Ehh, I kind of disagree. The work is the same, at best it shifts to something else. Asking for more productivity is a monkey paw. Best to just take it all in and try to enjoy the simple joys of life. Or, uh, work.

Re: OpenClaw is a security nightmare dressed up as a daydream

#177

Post by mmarian »

FpUser wrote: post #170
mjr00 wrote: post #44

Earlier quoted context omitted.

> why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. This AI wave is filled with "ideas guys/gals" who thought they had an amazing awesome idea and if only they knew how to program they could make a best-selling billion dollar idea, being confronted with the reality that their ideas are really uninteresting as well. They're still happy to…

I have "new genius" ideas very often. After doing quick search I discover that any idea worth thinking of implementation is either implemented already or what seems to be low barrier to entry clashes with some legal obstacles.

Story of my life.

Re: OpenClaw is a security nightmare dressed up as a daydream

#178

Post by procone »

mandeepj wrote: post #172
Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

> booking a flight > Doing this manually is already pretty trivial No, it’s not! You are the one who made it trivial by using three words to define! How about if I could only fly out between 9 am-noon next Friday? Also, combine it with hotel and rental car. Many times total $ between sites could be a difference of close to $200 or more along with better itinerary. That’s just the surface. The more preferences you add…

Still sounds trivial. Not sure why you're trying to make travel sound like a complex problem that can only be solved by burning tokens.

Re: OpenClaw is a security nightmare dressed up as a daydream

#179

Post by simonw »

_pdp_ wrote: post #142
feznyng wrote: post #106

Earlier quoted context omitted.

That isn't secure is the issue, the more things you have it hooked up to the more havoc it can cause. The environment being locked down doesn't help when you're giving it access to potentially destructive actions. And once you remove those actions, you've neutered it.

The openclaw security model is the equivalent of running as root - i.e. full access. If that is insecure the inverse of it is running without any access as default and adding the things that you need. This is pretty much standard security 101. We don't need to reinvent the wheel.

The unsolved security challenge is how to give one of these agents access to private data while also enabling other features that could potentially leak data to an attacker (see the lethal trifecta.)

That's the product people want - they want to use a Claw with the ability to execute arbitrary code and also give it access to their private data.

Re: OpenClaw is a security nightmare dressed up as a daydream

#180

Post by volkercraig »

FpUser wrote: post #170
mjr00 wrote: post #44

Earlier quoted context omitted.

> why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. This AI wave is filled with "ideas guys/gals" who thought they had an amazing awesome idea and if only they knew how to program they could make a best-selling billion dollar idea, being confronted with the reality that their ideas are really uninteresting as well. They're still happy to…

I have "new genius" ideas very often. After doing quick search I discover that any idea worth thinking of implementation is either implemented already or what seems to be low barrier to entry clashes with some legal obstacles.

Interestingly that sort of research is actually what I've used Claude/Chatgpt deep research and openclaw for. If I have an idea, I get an agent to go and do some product research for me and see if there is a market, if anyone has tried it, and if there is anyone doing it.

It has unironically saved me a lot of time I would have otherwise spent going down rabbit holes.

Of the models I've found that claude doesn't gas you up as much as GPT, so for stuff like this where the answer can be "no, that's not a good idea" I usually use claude.

Post reply on HN