Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
GavCo 1 days ago [-]
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today:
Unhardened: docker.io/nanoco/nanoclaw:agent-alpha
71 packages, 344 unique CVEs, linux/arm64
PACKAGE VERSION TYP C H M L N TOT
-----------------------------------------------------------
expat 2.5.0 deb 0 4 18 1 2 25
curl 7.88.1 deb 4 4 6 0 7 21
hono 4.12.14 npm 0 1 18 2 0 21
libtiff 4.5.0 deb 0 2 1 1 15 20
perl 5.36.0 deb 5 6 3 0 3 17
pnpm 10.33.0 npm 0 8 7 0 0 15
glibc 2.36 deb 1 2 2 1 7 13
openjpeg 2.5.0 deb 0 0 3 1 9 13
cups 2.4.2 deb 0 2 8 0 1 11
glib2 2.74.6 deb 1 7 1 0 1 10
tar 1.34(+2) deb 1 1 7 0 1 10
llvm 15.0.6 deb 0 0 0 1 9 10
sqlite3 3.40.1 deb 1 2 3 0 3 9
nss 3.87.1 deb 1 0 3 0 4 8
avahi 0.8 deb 0 0 8 0 0 8
util-linux 2.38.1 deb 0 0 3 0 2 7
elf 0.188 deb 0 0 0 0 7 7
libssh2 1.10.0 deb 1 4 1 0 0 6
openldap 2.5.13 deb 0 1 0 0 5 6
chromium 151.0.7922.108 deb 0 5 0 0 0 5
-----------------------------------------------------------
UNIQUE CVEs 16 68 121 17 119 344
(+51 more packages, 102 findings)
C/H/M/L/N = critical/high/medium/low/negligible.
Counts are unique CVEs: binaries from one source package are
grouped (libcurl4 + libcurl3-gnutls + curl = curl), so a CVE
hitting three of them counts once, not three times.
m4rtink 10 hours ago [-]
So it has too many dependencies l, which are themselves also CVE magnets ?
Maybe they could depend on less items that are more secure ?
viccis 1 days ago [-]
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
hylaride 24 hours ago [-]
Most modern scanners know the backported versions for the major vendors (ubuntu/debian/rhel/alpine), but it was definitely an issue a decade ago.
lokar 1 days ago [-]
That’s not security, it’s compliance.
24 hours ago [-]
1 days ago [-]
devin 1 days ago [-]
If the thing measuring whether there are CVEs is also the thing creating said CVEs, are we sure they are even CVEs? Deduped? Etc.
1 days ago [-]
1 days ago [-]
mohamedkoubaa 1 days ago [-]
Hold my beer
random3 1 days ago [-]
It’s like it’s made of CVEs. First 50-100 should be a good sign if it’s cleaner to start over.
prymitive 1 days ago [-]
For those unfamiliar, “CVE” stands for “CV Enrichment”, common slang in Posture Engineering
Discovered a new legit CVE today during a meeting with some other engineers. I’m going to make sure the one who originally brought it up gets to put it on his résumé. The world needs more people like that.
482937632992 1 days ago [-]
"'They' just don't want you to know how incredibly secure this vibeslopped clawshit is."
tptacek 1 days ago [-]
If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.
doc_ick 5 hours ago [-]
So they do matter, just unlikely to be executed.
aliasxneo 1 days ago [-]
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
lokar 1 days ago [-]
My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.
chrismorgan 24 hours ago [-]
I don’t say it’s the case there (it probably isn’t, you probably need hardware access or root), but sometimes those sorts of things do actually matter because there’s a way of causing them to be run anyway.
This is why it’s good to exclude things you don’t need. The less there is, the fewer places there are for problems to lurk.
lokar 23 hours ago [-]
Not against fixing it, but at the next normal update, it an emergency.
sriram_sun 24 hours ago [-]
Why is that even part of the image?
lokar 23 hours ago [-]
It was a stock/default kernel setup, before my time.
nathancahill 1 days ago [-]
This is how Vanta et al. make millions.
paulryanrogers 23 hours ago [-]
I don't think Vanta itself even scans for CVEs? They scan for compliance which includes tooling that may look for CVEs, like Dependabot.
Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.
evanjrowley 1 days ago [-]
Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
itintheory 1 days ago [-]
It's the opposite of NIH syndrome. Need to left pad a string? Just import a library from some rando on the internet!
sophacles 1 days ago [-]
When node was new there were many browsers (different rendering and js engines, not just chrome reskins) and standards and "proto standards" were moving very fast. Different browsers and versions would have very different support for CSS directives, tag behavior, etc. This was a real pain in the ass to make a site consistent across different browsers - every other line of code would require a full switch statement based on browser and version it seemed, and all of these things would need updating every time some browser had an update.
The answer to this was something called polyfills, a library that did something as simple as element.center() with just 500 lines of code to make it consistent on all browsers, and all the places you want to center that element are updated by the polyfill authors and your code doesn't need to be touched.
All the sites that weren't using good polyfills broke (or at least looked terrible) for days every time there was a new $browser update.
Since thats the javascript environment node was born into, the style was carried over by inertia and habit, for better and worse.
tptacek 24 hours ago [-]
Because it's written in Javascript and there are classes of highly-situational and not-especially-meaningful vulnerabilities that broadly impact the entire ecosystem ("prototype pollution" is the canonical example) that get counted individually in every occurrence in every NPM package.
It's not a real number, and, worse, it obscures the real figure of merit (/demerit). The Node ecosystem does have a real problem with its culture of sprawling dependencies. But it's not the first-order issue with this "1400" number.
ljm 1 days ago [-]
Because, like it or not, it does Write Once, Use Anywhere better than Java ever did.
It is pretty much the lowest common denominator for code.
shimman 24 hours ago [-]
Because it's written by a type of dev that thinks everything should use JS because that's what they used for 6 months while working at a FAANG company before getting laid off and since they worked at a FAANG company clearly they know better than you so if you attack them for using an extremely poor language you just aren't a seriously person so please shut up while I go fishing for some VC funds.
It's like asking why Claude Code is written with react, because the devs getting paid >$500k a year clearly know better d'uh.
eviks 1 days ago [-]
Primarily because of the original sin of JS being an awfully designed language.
Partially because it's the most popular.
iandanforth 1 days ago [-]
I don't understand the 'custom patch' strategy over 'fix the app with a major version change' strategy.
raver1975 1 days ago [-]
That's what happens when you vibe code.
KaiserPro 1 days ago [-]
so s/bookworm/trixie/g didn't work then?
Yes, this is mostly a joke, I am able to understand the difference between base distros.
iririririr 1 days ago [-]
a spot on "joke". deb12 is gone for a month now.
KaiserPro 3 hours ago [-]
although as of today, python-trixie has three CVEs, two of which are perl
pokstad 18 hours ago [-]
I was intrigued by nano claws more “secure” marketing, but I couldn’t believe how loose and vibe coded the installation and set up process was. My god it’s full of prompts.
eviks 1 days ago [-]
What is NanoClaw? Glad you asked:
> NanoClaw is a secure, lightweight alternative to OpenClaw.
overgard 1 days ago [-]
I'm pretty skeptical you can call any claw-like thing secure unless you solve prompt injection.
stavros 24 hours ago [-]
Security isn't binary. There's nothing that's "secure" unless you define a threat model first.
TZubiri 24 hours ago [-]
Sounds like the kind of stuff devs that introduce security vulnerbilities say.
r14c 19 hours ago [-]
if you can't define a threat model, or know why you need one, you will write vulnerable code.
stavros 24 hours ago [-]
Unrelatedly, I wonder why I don't see the downvote arrows on comments any more.
Hamuko 1 days ago [-]
If the lightweight alternative has 1400 CVEs, how many does OpenClaw have?
sajithdilshan 1 days ago [-]
I wonder how many new CVEs were introduced while patching these
bryan0 1 days ago [-]
Why hasn't looking at EPSS (Exploit Prediction Scoring System) become a more standard approach than just raw CVEs?
Surac 1 days ago [-]
let me guess. they wrote a promt that told claude do undo all bugs?
cdnsteve 23 hours ago [-]
What do you use for Nanoclaw's sandboxing?
Rendered at 17:27:16 GMT+0000 (Coordinated Universal Time) with Vercel.
Maybe they could depend on less items that are more secure ?
https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exp...
This is why it’s good to exclude things you don’t need. The less there is, the fewer places there are for problems to lurk.
Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.
The answer to this was something called polyfills, a library that did something as simple as element.center() with just 500 lines of code to make it consistent on all browsers, and all the places you want to center that element are updated by the polyfill authors and your code doesn't need to be touched.
All the sites that weren't using good polyfills broke (or at least looked terrible) for days every time there was a new $browser update.
Since thats the javascript environment node was born into, the style was carried over by inertia and habit, for better and worse.
It's not a real number, and, worse, it obscures the real figure of merit (/demerit). The Node ecosystem does have a real problem with its culture of sprawling dependencies. But it's not the first-order issue with this "1400" number.
It is pretty much the lowest common denominator for code.
It's like asking why Claude Code is written with react, because the devs getting paid >$500k a year clearly know better d'uh.
Yes, this is mostly a joke, I am able to understand the difference between base distros.
> NanoClaw is a secure, lightweight alternative to OpenClaw.