SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Security researchers flag two risks in NVIDIA NeMo .nemo model files that scanners may miss

0
·1 views

NVIDIA NeMo stores models as .nemo files, which are tar archives holding a config and a torch checkpoint that is a pickle, so the checkpoint can carry code-execution payloads. Many pickle scanners do not unpack the outer tar, leaving that payload undetected. A separate flaw in NeMo releases before r2.0.0rc0 failed to sanitise tar member names, allowing a crafted file to write outside the extraction folder (CWE-22, NVD score 7.8). The author released nemo_container_scan.py, an open-source Apache-2.0 tool that inspects .nemo contents in memory without extracting or unpickling anything. It exits with an error code on high-severity findings so it can gate CI pipelines, though it performs static review only and does not prove exploitability.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Student Adds UFW, Fail2Ban and Logwatch to Ubuntu Server Within Wazuh SIEM Setup

A new cybersecurity learner, who works as a full-time teacher, enhanced an existing Ubuntu server and its Wazuh SIEM monitoring environment. The project added three tools: UFW to control incoming traffic, Fail2Ban to ban IPs after repeated failed SSH logins, and Logwatch to compile system logs into readable reports. Testing with Nmap from Kali Linux showed UFW filtering the blocked port, while Fail2Ban successfully banned an attacking IP during a simulated SSH password-guessing attempt. Wazuh recorded the events, and Logwatch delivered a summary report to the server's root mailbox. The author's tests were aligned with MITRE ATT&CK technique T1046, Network Service Discovery.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Seven-Day Retention Logging for Node.js Game Notifications Balances Debugging and Data Minimization

The article argues that a production log for notification delivery should capture enough detail to reconstruct a failed send without storing every player action permanently. It recommends a Node.js-friendly ingestion API with a short seven-day retention window, a stable event schema, and a separate plan for alerting and deletion. The author distinguishes simple event collection from full observability, which would include alert rules, span-tree analysis, and GDPR deletion workflows. Storage cost is framed as event volume multiplied by retained bytes, using a sizing example of about 1.4 GB per week for two million events. The recommended record keeps identifiers, attempt number, status, timestamp, provider, and a correlation ID, while omitting full request bodies to limit sensitive content.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why SaaS onboarding should be designed as a conversion funnel, not a form

The article argues that most SaaS onboarding is built like paperwork, collecting information without considering how each step affects whether users stay engaged. It treats activation as a funnel where every step has a drop-off rate that results from design choices. The author's company orders its steps as signup, then card, then connect, since a committed card holder is more likely to finish connecting. Their key metric is the share of trials connected within 24 hours, which they see as a signal of overall health, and they attribute dips to steps that demand trust too early or confusing instructions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Swipe Again Charges a Flat Fee Instead of a Percentage of Recovered Payments

The article argues that percentage-based pricing for payment-recovery tools can grow into a large cost for merchants, since the vendor's fee rises with the size of the merchant's losses. It uses an example of a store losing $40,000 in failed payments a year, recovering a third of that, and facing a fee that climbs annually with the business. By contrast, a flat fee caps the vendor's revenue regardless of how much is recovered, aligning its incentives differently. The author cites Swipe Again's $179 flat-fee model as an example and explains its reasoning on the company's pricing page. The piece contends that percentage models de-risk the vendor's sale but shift risk onto merchants over time.

0 comments Read more at DEV Community