Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We eliminated 1,400 CVEs in NanoClaw's container images

echo.ai

Post reply on HN
Print view View original

51–54 of 54 posts

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#51

Post by m4rtink »

GavCo wrote: post #8
halestock wrote: post #3

Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.

These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today: Unhardened: docker.io/nanoco/nanoclaw:agent-alpha 71 packages, 344 unique CVEs, linux/arm64 PACKAGE VERSION TYP C H M L N TOT ----------------------------------------------------------- expat 2.5.0 deb 0 4 18 1 2 25 curl 7.88.1 deb 4 4 6 0 7 21 hono 4.12.14 npm 0 1 18 2 0 21 libtiff 4.5.0 de…

So it has too many dependencies l, which are themselves also CVE magnets ?

Maybe they could depend on less items that are more secure ?

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#52

Post by doc_ick »

tptacek wrote: post #18

If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.

So they do matter, just unlikely to be executed.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#53

Post by KaiserPro »

iririririr wrote: post #13
KaiserPro wrote: post #2

so s/bookworm/trixie/g didn't work then? Yes, this is mostly a joke, I am able to understand the difference between base distros.

a spot on "joke". deb12 is gone for a month now.

although as of today, python-trixie has three CVEs, two of which are perl
Post reply on HN