Finding thousands of exposed Ollama instances using Shodan

Similarly a lot of projects using gradio come with a tunnel/public proxy enabled out of the box. ie instantly publicly accessible just by running it. Behind a long unique uuid looking url which provides some measure of security by obscurity but wow was still surprised first time I saw that.

Must be a good time to be in security space with this sort of stuff plus the inevitable vibe code security carnage

> Behind a long unique uuid looking url which provides some measure of security by obscurity

That's not security by obscurity.

If the "uuid looking" part is generated using a csprng and has enough entropy, it has the same security properties as any other secret.

There's other issues with having the secret in the URL.

Not when the user leaks their DNS query it doesn't. Those endpoints must be one of the dumbest "vibe security" ideas I've literally ever heard of.