We eliminated 1,400 CVEs in NanoClaw's container images

KaiserPro

so s/bookworm/trixie/g didn't work then? Yes, this is mostly a joke, I am able to understand the difference between base distros.

halestock

Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.

iandanforth

I don't understand the 'custom patch' strategy over 'fix the app with a major version change' strategy.

aliasxneo

I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.

evanjrowley

Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?

tptacek

If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.

Surac

let me guess. they wrote a promt that told claude do undo all bugs?

bryan0

Why hasn't looking at EPSS (Exploit Prediction Scoring System) become a more standard approach than just raw CVEs?

prymitive

For those unfamiliar, “CVE” stands for “CV Enrichment”, common slang in Posture Engineering

raver1975

That's what happens when you vibe code.

sajithdilshan

I wonder how many new CVEs were introduced while patching these

eviks

What is NanoClaw? Glad you asked: > NanoClaw is a secure, lightweight alternative to OpenClaw.

cdnsteve

What do you use for Nanoclaw's sandboxing?

pokstad

I was intrigued by nano claws more “secure” marketing, but I couldn’t believe how loose and vibe coded the installation and set up process was. My god it’s full of prompts.