Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keylogger discovered in image generator extension

old.reddit.com

Post reply on HN
Print view View original

71–80 of 102 posts

Re: Keylogger discovered in image generator extension

#71

Post by nsingh2 »

creata wrote: post #64
nsingh2 wrote: post #17

Earlier quoted context omitted.

Not as secure as VMs but GPU passthrough with Docker/Podman is much easier to set up, and you can even use the GPU on the host machine at the same time.

Are you giving it access to /dev/dri, or doing some fancier sandboxing? (Would you even need anything fancier? I think /dev/dri is supposed to isolate users.)

Nvidia provides a toolkit to do this [1], getting a GPU into a container is as easy as running `podman run --device nvidia.com/gpu=all`. The process is similar for Docker, but rootless Docker requires some extra steps IIRC.

[1] https://docs.nvidia.com/datacenter/cloud-native/container-to...

Re: Keylogger discovered in image generator extension

#73

Post by dysoco »

creata wrote: post #54

Why does there seem to be such a disregard for security in deep learning? There's examples like this post, but also, until recently, almost every deep learning model was literally distributed as a pickle file.

From my outsider perspective, it's a field that moves very fast, there seem to be new tools being released every week so:

1) As the developer if you focus on hardening, you might be too late to release.

2) People downloading shiny new libs/files/programs constantly.

3) Influx of people not that versed in the basics of computer security playing around with local LLM models, image generators, etc.

Re: Keylogger discovered in image generator extension

#75

Post by lyu07282 »

belladoreai wrote: post #69
Seattle3503 wrote: post #63

How do people feel about using docker to prevent this sort of thing? Does it strike the right balance between usability and security?

Well, Docker is great for this as long as you're not one of the unlucky few whose machine is bricked because of Docker. So, mostly yes, I suppose.

What does that even mean?

Re: Keylogger discovered in image generator extension

#76

Post by aintnolove »

I peered down the ComfyUI rabbit hole [1] and it is shockingly powerful. Did Adobe drop the ball on image generation? What are they doing over there? There has to be a better, more secure way to bundle up all this imagegen logic.

[1] https://learn.thinkdiffusion.com/bria-ai-for-background-remo...

Re: Keylogger discovered in image generator extension

#77

Post by creata »

FileSorter wrote: post #70
badrunaway wrote: post #66

what can be done to stop all this? We need some sort of OS level layer to validate these things. If we put a local LLM which checks the bytecode of things which are getting installed/running for security = will that solve all this? My heart goes out to those who must have lost their money due to this.

I think this is one of the use cases for a sandboxed WASM plugin system.

But almost everyone working on these plugins really wants to use Python and PyTorch.

Re: Keylogger discovered in image generator extension

#78

Post by belladoreai »

aintnolove wrote: post #76

I peered down the ComfyUI rabbit hole [1] and it is shockingly powerful. Did Adobe drop the ball on image generation? What are they doing over there? There has to be a better, more secure way to bundle up all this imagegen logic. [1] https://learn.thinkdiffusion.com/bria-ai-for-background-remo...

Yep, it's super powerful.

I would say that the "more secure way" is to just use ComfyUI without installing any obscure nodes from unknown developers. You can do pretty much anything using just the default nodes and the big node packs.

Re: Keylogger discovered in image generator extension

#79

Post by belladoreai »

lyu07282 wrote: post #75
belladoreai wrote: post #69

Earlier quoted context omitted.

Well, Docker is great for this as long as you're not one of the unlucky few whose machine is bricked because of Docker. So, mostly yes, I suppose.

What does that even mean?

"Bricking" is when your electronic device stops working, i.e. becomes a brick. Docker is known to occasionally brick Windows machines.

Re: Keylogger discovered in image generator extension

#80

Post by dmazzoni »

uyzstvqs wrote: post #39

I'm curious if it'd be possible to use a Code LLM to scan GitHub repos and detect possible malware hiding in source code.

If such a tool became commonplace, bad actors would just run it on their own malware and keep tweaking it until the LLM failed to detect it.
Post reply on HN