This is an automated archive made by the Lemmit Bot.
The original was posted on /r/stablediffusion by /u/campingtroll on 2024-09-01 09:52:55+00:00.
Apologies for long post ahead of time, but its all info I feel is important to be aware is likely happening on your PC right now.
I understand that telemetry can be necessary for developers to improve their apps, but I find this be be pretty unacceptable when location information is sent without clear communication.. and you might want to consider opting out of telemetry if you value your privacy, or are making personal AI nsfw things for example and don't want it tied to you personally, sued by some celebrity in the future.
I didn't know this until yetererday, but Gradio sends your actual IP address by default. You can put that code link from their repo in chatgpt 4o if you like. Gradio telemetry is on by default unless you opt out. Search for ip_address.
So if you are using gradio-based apps it's sending out your actual IP. I'm still trying to figure out if "Context.ip_address" they use bypasses vpn but I doubt it, it just looks like public IP is sent.
Luckily they have the the decency to filter out "str" and "dict" and set it to None, which could send sensitive info like prompts or other info when using kwargs, but there is nothing stopping someone from just modifying and it and redirecting telemetry with a custom gradio.
It's already has been done and tested. I was talking to a person on discord. and he tested this with me yesterday.
I used a junk laptop of course, I pasted in some modified telemetry code and he was able to recreate what I had generated by inferring things from the telemetry info that was sent that was redirected (but it wasn't exactly what I made) but it was still disturbing and too much info imo. I think he is security researcher but unsure, I've been talking to him for a while now, he has basically kling running locally via comfyui... so that was impressive to see. But anyways, He said he had opened an issue but gradio has a ton of requirements for security issues he submitted and didn't have time.
I'm all for helping developers with some telemetry info here and there, but not if it exposes your IP and exact location...
With that being said, this gradio telemetry code is fairly hard for me to decipher in analytics.py and chatgpt doesn't have context of other the outside files (I am about to switch to that new cursor ai app everyone raving about) but in general imo without knowing the inner working of gradio and following the imports I'm unsure what it sends, but it definitely sends your IP. it looks like some data sent is about regarding gradio blocks (not ai model blocks) but gradio html stuff, but also a bunch of other things about the model you are using, but all of that can be easily be modified using kwargs and then redirected if the custom gradio is modified or requirements.txt adjusted.
The ip address telemetry code should not be there imo, to at least make it more difficult to do this. I am not sure how a guy on discord could somehow just infer things that I am doing from only telemetry, because he knew what model I was using? and knew the difference in blocks I suppose. I believe he mentioned weight and bias differences.
OPTING OUT: To opt out of telemetry on windows can be more difficult as every app that uses a venv is it's own little virtual environment, but in linux or linux mint its more universal. But if you add this to activate.bat in /venv/scripts/activate on your ai app in windows you should be good besides windows andtelemetry, add this to any activate.bat and your main python PATH environment also just to be sure:
export GRADIO_ANALYTICS_ENABLED="False"
export HF_HUB_OFFLINE=1
export TRANSFORMERS_OFFLINE=1
export DISABLE_TELEMETRY=1
export DO_NOT_TRACK=1
export HF_HUB_DISABLE_IMPLICIT_TOKEN=1
This opts out of both gradio and huggingface telemetry, huggingface sends quite a bit if info also without you really knowing and even send out some info on what you have trained on, check hub.py and hf_api.py with chatgpt for confirmation, this is if diffusers being used or imported.
So the cogvideox you just installed and that you had to pip install diffusers is likely sending telemetry right now. Hopefully you add opt out code on the right line though, as even as being what I would consider failry deep into this AI stuff I am still unsure if I added it to right spots, and chatgpt contradicts itself when I ask.
But yes I had put this all in the activate.bat on the Windows PC and Im still not completely sure, and Nobody's going to tell us exactly how to do it so we have to figure it out ourselves.
I hate to keep this post going.. sorry guys, apologies again, but feels this info important: The only reason I confirmed gradio was sending out telemetry here is the guy I talked to had me install portmaster (guthub) and I saw the outgoing connections popping up to "amazonaws.com" which is what gradio telemetry uses if you check that code, and also is used many things so I didn't know, Windows firewall doesn't have this ability to realtime monitor like these apps.
I would recommend running something like portmaster from github or wfn firewall (buggy use 2.6 on win11) from guthub to monitor your incoming and outgoing traffic or even wireshark to analyze packets if you really want i get into it.
I am identity theft victim and have been scammed in the past so am very cautious as you can see... and see customers of mine get hacked all the time.
These apps have popups to allow you to block the traffic on the incoming and outgoing ports in realtime and gives ore control. It sort of reminds me of the old school days of zonealarm app in a way.
Linux OPT out: Linux Mint user that want to opt out can add the code to the .bashrc file but tbh still unsure if its working... I don't see any popups now though.
Ok last thing I promise! Lol.
To me I feel this is AI stuff sort of a hi-res extension of your mind in a way, just like a phone is (but phone is low bandwidth connection to your mind is very slow speed of course) its a private spaces and not far off from your mind, so I want to keep the worms out that are trying to sell me stuff, track me, fingerprint browser, sell me things, make me think I shouldn't care about this while they keep tracking me.
There is always the risk of scammers modifying legitimate code like the example here but it should not be made easier with io address code (btw that guy I talk to is not a scammer.
Tldr; it should not be so difficult to opt out of ai related telemetry imo, and your personal ip address should never be sent. Hope this is useful to someone.
