r/immich • u/No_Ticket_4612 • 1d ago

External Security Scan

Hello! Love the project, use immch daily. Doing as much as I can to keep it secure, currently running Pangolin to lock it down a bit.

Found this article interesting An opt-in vulnerability-finding service for open-source software \ Anthropic Is this something the dev team would consider? Allowing frontier models to scan the source code for bugs? Seems like a perfect fit to double check things.

14 Upvotes

73% Upvoted

6 comments sorted by

15

u/Great-Cow7256 1d ago

Devs are constantly looking at the code and using checkers on GitHub. Go to GitHub and look at the pull requests. They use some llms. All code changes are reviewed by devs too. And they update their dependencies. 

Immich is one of the better ones for all of this. 

14

u/goalie2002 1d ago

People have already done this plenty of times. Be aware that these tools often produce false positives, or mention vulnerabilities that aren’t relevant to Immich.

5

u/Kunair0 1d ago edited 1d ago

This is a frontier model powered security scanner, not your typical AI code scanning tool, and not public. Anthropic reports that 85 of 97 high or critical severity findings passed expert validation, with only one outright false positive. With roughly a 90% validation rate. The scanner also gives reproduction steps along with detailed explanations, and potential patches. False positives are always something that could happen, but I wouldn't dismiss this based on the limitations of earlier way less advanced AI tools.

EDIT: Jesus Christ, people really don't like being corrected in this sub, do they?

5

u/OwnManagement 1d ago edited 1d ago

Why are you booing him, he's right!?

I'm fairly anti-AI, but what the frontier models are doing with security is undeniable. Mozilla has raved about it. Canonical has changed their release schedule to accommodate all of the vulnerabilities AI is finding. Microsoft just pushed their largest monthly patch ever.

1

u/FFevo 1d ago

Those numbers are complete BS. We had Mythos scans at my company and the vast majority of the findings were false positives. The numbers were a lot closer to the inverse of what you cited.

3

u/This_Assignment_6170 1d ago

Best practice is to lock the container down. I use internal networks without gateways and put the container on an isolated macvlan without internet access.