Finding thousands of exposed Ollama instances using Shodan

Separation of concerns?

If you deploy a power plug outside your house, is it the fault of the power plug designer if people steal your power?

Put it behind a webserver with basic auth or whatever you fancy, done.

Bad analogies are bad analogies. ollama is a server system, it should expect to connect with more than one client and they know very well by now that this also means networked clients. If you create a server client protocol, implementing security is your job.

Any decent router is going to block connections from internet to your local network by default. For ollama to be accessible from the outside, they had to allow it explicitly. There's no way to blame ollama for this.

Lots of servers do not, Redis for instance does not have auth by default, and IIRC did not have auth at all for a long time.

> If you create a server client protocol, implementing security is your job.

Yes, this goes right along with the tried and true Unix philosophy: do everything, poorly. Wait what?

The client-server pattern is frequently used locally.

I cannot express how deeply wrong you are about this; a "server system" is not some mandate that it should be production ready for a ton of people on the internet.

This is a program that very different people want or need to try out that just so happens to involve a client-server architecture.