why this package? + some security considerations about gpu-jupyter HOT 13 CLOSED

Ohh, I thought you suggested jedi as password.

from gpu-jupyter.

also jedi is also not perfect (I had to downgrade yesterday to get tab-completion working in ipython ... it was crashing the session with every tabulation), will let you know if I have any issues with tabnine.

from gpu-jupyter.

confirmed. looked through my logs. brute force attempt eventually cracked the default password in under 30 hours. my fault for leaving the port open / password unchanged.
attackers set up cryptomining on the system. I found the payload. Looks like it ran for about two days before I caught it.

But anyway, this issue is about that package not working. Frankly, I don't trust a package that downloads its binary on startup, though that package in particular looks like it has a community, I am skeptical of the practice of pulling a file to site-packages on start up, so I'm glad it got a permissions denied error.

from gpu-jupyter.

Okay, interesting. I suggest we install tabnine (for auto-completion) via pip (pip install jupyter-tabnine) and change the default password. I admit, asdf was not intelligent, as it is short and used so often!
gpu-jupyter or gupyter would be better (at least if there is no web-scraper that extracts the password from the README). What do you think?

from gpu-jupyter.

what's wrong with the default jedi? I don't know if I need "deep learning" in my autocompletion

from gpu-jupyter.

Okay, do you think asdf was cracked because it is frequent? The number of characters would be the same.
As far as I know, some autocompletion algorithms use a recurrent network that estimates the propability of the next chars or valid variables/functions. I've also got used to that ;)

from gpu-jupyter.

Regarding jedi, there could be a webscraper that realizes that many Jupyter instances have that default password.
Maybe gpu-jedi would be better. What do you think?

from gpu-jupyter.

I've prepared a commit to solve the issues discussed here. Just let me know what password you prefer!

from gpu-jupyter.

@ChristophSchranz I do think asdf was too frequent. a phrase is much more secure. maybe something less guessable like gupyter_notebook?

and I don't follow re: jedi. What do you mean?

from gpu-jupyter.

(also to be clear, my main security flaw was opening the port to the internet instead of using a VPN... a stronger password would have been a second line of defense but ultimately the blame is on me for leaving the gate wide open and inviting intruders)

from gpu-jupyter.

@mathematicalmichael It happens easily that we forget about the first line of defense, therefore there should be a password that offers some defence ;)

from gpu-jupyter.

Hi,
I've changed the default password to gpu-jupyter (easy to remember and long enough) in af575a9
I've also solved an issua with tabnine, such that it is installed for a user in cd12d58.

Are you okay with those changes?

from gpu-jupyter.

yup. thanks!
checked the commit, glad to see they fixed the bug.

from gpu-jupyter.