Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?
Booking a flight is the kind of thing I want to dedicate my full attention to. It's expensive, and the timing and details matter a lot. I'm happy for the voice assistant to add stuff to my grocery list, though. The consequences are not serious if it screws up a letter or something.
OpenClaw is a security nightmare dressed up as a daydream
281–290 of 323 posts
Re: OpenClaw is a security nightmare dressed up as a daydream
#282Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?
I don't use Claw. It is way too dangerous. I built my own system where I know the ins and outs and how they can break. When it comes to agents' tasks, I tend to focus on things that I couldn't do before without automated agents, at least at the going price. The kind of automation I'm doing is more like building a set of agents to generate marketing surveys for me. They take free form input from me and my project. The…
Re: OpenClaw is a security nightmare dressed up as a daydream
#283Yes, yes it is. And it's amaaaazing. We're going to have lots of sharp edges getting stuff like this secured, but it is not going to go away. Too useful.
The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.
It's a) harder to setup, b) less functional out of the box, c) has almost exactly the same security risk surface -- either you hook it up to your email, comms, documents and give it API tokens, or you don't. If you do -- well, at least it can't delete your hard drive without turning full evil and looking for red pill type exploits that break the container -- but, it still has the same other security dynamics.
Anyway, employing a very suspicious watcher that's hooked to the shell and API calls is probably the way forward. Can that thing be reasoned with / tricked?
Re: OpenClaw is a security nightmare dressed up as a daydream
#284Re: OpenClaw is a security nightmare dressed up as a daydream
#285Re: OpenClaw is a security nightmare dressed up as a daydream
#286Kids need scissors. And they're inexperienced. So you give them kid-safe scissors. It makes it harder to cut themselves.
The same needs to take place with assets you want the bot to manage
- give access to a card with a total spend limit - read only access to some things, edit others - limited scope permissions
One of the reasons why I dragged my feet to use openclaw is that I knew security was an issue from the beginning. I thought by now where would be some solutions and there are, but I only found out from the community. I think there will need to be some level of ecosystem management. Apple does a good job. But for that you need resources and investment.
Re: OpenClaw is a security nightmare dressed up as a daydream
#287I'm a heavy OpenClaw user and I've been testing it in many different scenarios — the profundity of what I can do with it now is crazy. It's literally automating my life. Being AuDHD, OpenClaw feels like a big relief. The positive sides are amazing. The downsides... well, as with any security and any LLM, they're all prone to the same problems discussed here. Having Claude Code on yolo mode exposes you to the exact sa…
Re: OpenClaw is a security nightmare dressed up as a daydream
#288Earlier quoted context omitted.
I have "new genius" ideas very often. After doing quick search I discover that any idea worth thinking of implementation is either implemented already or what seems to be low barrier to entry clashes with some legal obstacles.
Interestingly that sort of research is actually what I've used Claude/Chatgpt deep research and openclaw for. If I have an idea, I get an agent to go and do some product research for me and see if there is a market, if anyone has tried it, and if there is anyone doing it. It has unironically saved me a lot of time I would have otherwise spent going down rabbit holes. Of the models I've found that claude doesn't gas y…
Re: OpenClaw is a security nightmare dressed up as a daydream
#289Earlier quoted context omitted.
> why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. This AI wave is filled with "ideas guys/gals" who thought they had an amazing awesome idea and if only they knew how to program they could make a best-selling billion dollar idea, being confronted with the reality that their ideas are really uninteresting as well. They're still happy to…
I have "new genius" ideas very often. After doing quick search I discover that any idea worth thinking of implementation is either implemented already or what seems to be low barrier to entry clashes with some legal obstacles.
That was adjusted for 80s. In todays world you can know whether something is worth pursuing in minutes. Tip - in 99.9% of cases its not, but you will still learn along the way. Maybe you find something new.
Re: OpenClaw is a security nightmare dressed up as a daydream
#290Earlier quoted context omitted.
The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.
It seems almost impossible. I spent the weekend comparing nanoclaw to openclaw - nanoclaw is a slightly more secure version - containerized filesystem basically - and very popular. It's a) harder to setup, b) less functional out of the box, c) has almost exactly the same security risk surface -- either you hook it up to your email, comms, documents and give it API tokens, or you don't. If you do -- well, at least it…