4 ms·

Thanks for the link to the repo. It's very useful. As for the checkpoint, I'm not allergic and I don't do security theater: https://github.com/myshell-ai/Open

Thanks for the link to the repo. It's very useful. As for the checkpoint, I'm not allergic and I don't do security theater: https://github.com/myshell-ai/OpenVoice?tab=readme-ov-file#installation https://github.com/myshell-ai/OpenVoice?tab=readme-ov-file#i... links to https://myshell-public-repo-hosting.s3.amazonaws.com/checkpoints_1226.zip https://myshell-public-repo-hosting.s3.amazonaws.com/checkpo...

peddling-brink 3y ago
Why do you call that security theater? I found and provided the information, but didn’t make it clickable. Anyone can decide for themselves to navigate there. Your comment comes off as passive aggressive.
- IshKebab 3y ago
  I think he's referring to your "defanging" which you implied was security related but doesn't actually achieve anything at all.
  - fieldcny 3y ago
    They are making you think about what you are doing before you click the link. that’s not theatre that’s keeping people from clicking arbitrary links to zip files which can auto-execute code once downloaded. I’d suggest that those who think it is theatre probably don’t understand the implications of that action.
    - arccy 3y ago
      just downloading a zip file won't auto execute anything. and you can't meaningfully review it without downloading it, so it pretty much is security theatre
    - seabass-labrax 3y ago
      On which operating systems can Zip files automatically self-execute? Android .APKs come to mind, although in this case, Android asks you whether you want to install the application and thus gives you a chance to prevent the execution.
    - IshKebab 3y ago
      We understand exactly the implications of that action. There are no implications. Simply downloading a zip from Amazon has zero risk. Even opening an arbitrary zip has essentially zero risk. RCE from opening a zip is obviously a really critical and valuable vulnerability and would not be wasted with a public link. Combine that with the fact that this comes from a voice cloning GitHub repo and the chance of this having some 0-day are infinitesimal. Finally just making the link non-clickable does not add security. Nobody can take any action to increase their security because they have to slightly edit a link (not that they would because it's sensible a clickable link in the GitHub readme). So yes, I fully understand the implications and it is definitely security theatre. I suggest that those who think that it isn't probably haven't really thought about the threat model.
      - peddling-brink 3y ago
        I'll be honest. You've put way more thought into this then I did. But in the spirit of hacker news, I'll continue the argument. > There are no implications. Untrue and absolutist. > Simply downloading a zip from Amazon has zero risk. Agreed. > Even opening an arbitrary zip has essentially zero risk. RCE from opening a zip is obviously a really critical and valuable vulnerability and would not be wasted with a public link. Broadly agreed. History is full of unzip vulns, but I agree that this doesn't seem likely. Much easier to persuade folks to deliberately run their malware by using the latest fad as a hook. I'm not claiming that happened here. > Combine that with the fact that this comes from a voice cloning GitHub repo and the chance of this having some 0-day are infinitesimal. Maybe you know these authors and this repo and trust them. I don't. I'm sure they are lovely, I have no idea, I've done no research, and I've never heard of them before. That being said, if I wanted to distribute a backdoor or cryptominer to a bunch of people with powerful computers, I'd definitely hop on the AI bandwagon. > Finally just making the link non-clickable does not add security. I disagree. Some of the commenters here are rather savvy and will properly evaluate what they are downloading. Some are not. Making a link unclickable will prevent a percentage of people from downloading. If shenanigans are discovered, someone will make a very loud comment warning folks to avoid the download. In that case some of those non-downloaders may have been saved from themselves. Again, this wasn't a well thought out decision, but it was also a rather low impact decision, and I stand by it.
- janalsncm 3y ago
  What is the threat vector of the functional https link that hxxps solves?

peddling-brink 3y ago

Why do you call that security theater? I found and provided the information, but didn’t make it clickable. Anyone can decide for themselves to navigate there. Your comment comes off as passive aggressive.

IshKebab 3y ago
I think he's referring to your "defanging" which you implied was security related but doesn't actually achieve anything at all.
- fieldcny 3y ago
  They are making you think about what you are doing before you click the link. that’s not theatre that’s keeping people from clicking arbitrary links to zip files which can auto-execute code once downloaded. I’d suggest that those who think it is theatre probably don’t understand the implications of that action.
  - arccy 3y ago
    just downloading a zip file won't auto execute anything. and you can't meaningfully review it without downloading it, so it pretty much is security theatre
  - seabass-labrax 3y ago
    On which operating systems can Zip files automatically self-execute? Android .APKs come to mind, although in this case, Android asks you whether you want to install the application and thus gives you a chance to prevent the execution.
  - IshKebab 3y ago
    We understand exactly the implications of that action. There are no implications. Simply downloading a zip from Amazon has zero risk. Even opening an arbitrary zip has essentially zero risk. RCE from opening a zip is obviously a really critical and valuable vulnerability and would not be wasted with a public link. Combine that with the fact that this comes from a voice cloning GitHub repo and the chance of this having some 0-day are infinitesimal. Finally just making the link non-clickable does not add security. Nobody can take any action to increase their security because they have to slightly edit a link (not that they would because it's sensible a clickable link in the GitHub readme). So yes, I fully understand the implications and it is definitely security theatre. I suggest that those who think that it isn't probably haven't really thought about the threat model.
    - peddling-brink 3y ago
      I'll be honest. You've put way more thought into this then I did. But in the spirit of hacker news, I'll continue the argument. > There are no implications. Untrue and absolutist. > Simply downloading a zip from Amazon has zero risk. Agreed. > Even opening an arbitrary zip has essentially zero risk. RCE from opening a zip is obviously a really critical and valuable vulnerability and would not be wasted with a public link. Broadly agreed. History is full of unzip vulns, but I agree that this doesn't seem likely. Much easier to persuade folks to deliberately run their malware by using the latest fad as a hook. I'm not claiming that happened here. > Combine that with the fact that this comes from a voice cloning GitHub repo and the chance of this having some 0-day are infinitesimal. Maybe you know these authors and this repo and trust them. I don't. I'm sure they are lovely, I have no idea, I've done no research, and I've never heard of them before. That being said, if I wanted to distribute a backdoor or cryptominer to a bunch of people with powerful computers, I'd definitely hop on the AI bandwagon. > Finally just making the link non-clickable does not add security. I disagree. Some of the commenters here are rather savvy and will properly evaluate what they are downloading. Some are not. Making a link unclickable will prevent a percentage of people from downloading. If shenanigans are discovered, someone will make a very loud comment warning folks to avoid the download. In that case some of those non-downloaders may have been saved from themselves. Again, this wasn't a well thought out decision, but it was also a rather low impact decision, and I stand by it.
janalsncm 3y ago
What is the threat vector of the functional https link that hxxps solves?