5 ms·
Ollama has no auth mechanism by default... You have to wonder why they never focused on that
by ekianjo 1y ago
Ollama has no auth mechanism by default... You have to wonder why they never focused on that
- muldvarp 1y agoShould have asked an LLM to write one.
- cedws 1y agoI don’t think it was intended for production workloads.
- 47282847 1y agoSeparation of concerns? If you deploy a power plug outside your house, is it the fault of the power plug designer if people steal your power? Put it behind a webserver with basic auth or whatever you fancy, done.
- ekianjo 1y agoBad analogies are bad analogies. ollama is a server system, it should expect to connect with more than one client and they know very well by now that this also means networked clients. If you create a server client protocol, implementing security is your job.
- phito 1y agoAny decent router is going to block connections from internet to your local network by default. For ollama to be accessible from the outside, they had to allow it explicitly. There's no way to blame ollama for this.
- graemep 1y agoLots of servers do not, Redis for instance does not have auth by default, and IIRC did not have auth at all for a long time.
- Zambyte 1y ago> If you create a server client protocol, implementing security is your job. Yes, this goes right along with the tried and true Unix philosophy: do everything, poorly. Wait what?
- kube-system 1y agoThe client-server pattern is frequently used locally.
- jrm4 1y agoI cannot express how deeply wrong you are about this; a "server system" is not some mandate that it should be production ready for a ton of people on the internet. This is a program that very different people want or need to try out that just so happens to involve a client-server architecture.
- rvz 1y ago[flagged]
- Gormo 1y agoOllama doesn't run a web server that is "broadcasting across the internet". It runs a server that is accessible locally. You have to deliberately deploy it onto a public server in order for it to be accessible from the internet.
- rvz 1y agoIn all cases, having zero auth at all [0] even when others want to use it as a service to broadcast across the internet is ridiculous. Leading to problems like this: [1] and now all exposed without any protection. Even allowing others to change the $OLLAMA_HOST env is a security footgun. [0] https://github.com/ollama/ollama/issues/849 https://github.com/ollama/ollama/issues/849 [1] https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032 https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2...
- Gormo 1y agoThe idea is that you add an auth layer if that's what you want to do. The majority of Ollama users at the moment are likely hobbyists working in single-user contexts. For those who want to deploy it in an organizational setting, it's straightforward to put it behind a pre-existing authenticaton system.
- A4ET8a8uTh0_v2 1y agoAs cynical as I am, I honestly don't think there is much to wonder about here. The initial product's adoption relied on low friction and minimal setup. That they wanted to keep it going as long as possible is just an extension of this.
- Zambyte 1y agoThe dockerd TCP socket has no auth mechanism by default... You have to wonder why they never focused on that.