- The Unsloth studio docs say ...
Privacy first + Secure
Unsloth Studio can be used 100% offline and locally on your computer. Its token-based authentication, including encrypted password and JWT access / refresh flows keeps your data secure.
... yet the install script/developer install steps/documentation all use 0.0.0.0 as the default host which allows a much larger network attack surface than required for localhost offline use.
- The install via curl piped to bash method also states no where up front that it starts a non local host bound facing instance at end of installation with no choice for the user to proceed or not with such execution prior and shows the final message with the machines external facing internet ip address as the link to open.
Solution:
-
Changing the default host address to be 127.0.0.1 instead of 0.0.0.0 across install / script defaults and documentation on repo / website
-
Not auto starting an Unsloth studio instance as part of the install steps without confirmation or notice prior in install instructions or prompt at end of install before auto starting it.
... yet the install script/developer install steps/documentation all use 0.0.0.0 as the default host which allows a much larger network attack surface than required for localhost offline use.
Solution:
Changing the default host address to be 127.0.0.1 instead of 0.0.0.0 across install / script defaults and documentation on repo / website
Not auto starting an Unsloth studio instance as part of the install steps without confirmation or notice prior in install instructions or prompt at end of install before auto starting it.