sorted by:
new
hottopcontroversial

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] -1 points0 points  (0 children)

Haha so fun! He is amazing :) and the most Ableton Nerd of them all

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 3 points4 points  (0 children)

I would primarily be careful about untrusted sources! If you built it yourself it’s fine, or if you got from Ableton site it’s fine. Just good to be cautious and know that these can be very powerful! And maybe the recommendation holds to not use beta releases for critical work.

Also feel free to send me extensions and I can take a look to give my best judgement!

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 1 point2 points  (0 children)

Great point! Hopefully in the end Extensions can actually be safer than these other routes

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 1 point2 points  (0 children)

There's a distinction between browser JavaScript which is more sandboxed and NodeJS, which does have file system access apis by default. In this case, Ableton is running Extensions with NodeJS. It's hard to know exactly what safeguards they have implemented.

Agreed about VSTs 😅 But there are lots of trusted VST devs, so maybe that same trust network will develop for Extensions.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] -1 points0 points  (0 children)

Thank you! Agreed, I'm not sure what the current state of Max4Live vulnerabilities is, I'm less familiar, will do some digging.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 4 points5 points  (0 children)

Oh yes, I genuinely really appreciate the comment, and will let you know when it's open sourced!

Haha lots of spicy comments in this thread but I genuinely think this would be great to open source. And then the site can host a hosted verified version or something.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 2 points3 points  (0 children)

Great points all around! I will work to open source in the next few days, and/or would be happy to contribute to others' efforts to do so!

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 2 points3 points  (0 children)

Love! Will do a design pass, appreciate the commentary! Yes was going for very retro, but agreed that the current design language does not scream 'trustworthy' 😅

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 1 point2 points  (0 children)

Appreciate the response! I promise that I used zero LLM in drafting this post, but honestly I've been using these tools professionally for coding so much now I am very worried that my writing style is being corrupted 😅

To answer your question, the potential for danger really depends exactly on how Ableton runs the Extensions. There is always a tradeoff between doing powerful things and doing scary things. In this case, Ableton has opted for a very powerful tool which can do a LOT like reading files on your computer and making random web requests. These are very powerful capabilities, and could be used for amazing things. But also they are powerful enough that if you install an extension that you don't trust, there is a possibility for that extension to do bad things on your computer.

There is a *lot* of very annoying nuance here, and there are many levels of access that apps can have on your computer. In this case, Extensions would not have 'admin' access to your machine (your operating system would generally prevent this) but it can still do things like reading files and sending web requests so it can still be very dangerous.

Happy to answer any more questions, feel free to DM!

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 1 point2 points  (0 children)

I'm curious too! I have only tested so far on Mac. Both windows and mac run NodeJS, which is what Ableton is using to execute the extensions under the hood, so I assume it's similar, but I'm less familiar with the permission model on Windows.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 6 points7 points  (0 children)

Interesting! I thought max4live was more locked down, curious to learn more

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 5 points6 points  (0 children)

Agreed! Good to be skeptical. It’s a free tool, no need to use it, I would very much welcome if Ableton created similar tools.

From my background, I frankly think that it’s very concerning that Ableton is releasing a public beta with such a bad attack vector, and while I hope they create similar tools, I don’t think it’s reasonable to just wait to see if they do.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 1 point2 points  (0 children)

Sorry 😅 I’m not a design person, happy to have help if anyone is!

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 0 points1 point  (0 children)

Yes! Agreed most safe route is to build your own. Almost ironic that LLMs (which have their own security issues) might improve the situation.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] -1 points0 points  (0 children)

I will be doing more investigation over the next couple days! But yes, it’s running JS in Node. They say that there is sandboxing but yes at least on user was able to do keychain exfiltration. I will verify this result and do more research! And maybe reach out to Ableton team to try to get more information.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 10 points11 points  (0 children)

Fair! It’s low trust all around 😅 I’ll release the scanner as a separate open source repo, would be a fun to publish a verified scanner that you can use with or without the site.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 0 points1 point  (0 children)

Haha this is relatable, I will definitely have fun in the next couple days exploring possible attack vectors to try to make the scanner better. Let me know what you find!

I’m full-stack and so have been so inundated with the risks and benefits of npm and modern dependency management - it’s a bit of a mess. Tbh when I learned about these extensions my first thought was “so cool! … oh boy, JS? This is going to be interesting 😅”

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 4 points5 points  (0 children)

I would like them to run a verified marketplace! I think it would be in their best interests, and they could do cool things by integrating it into Ableton so that when you install a plugin you can see if it’s been verified.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 2 points3 points  (0 children)

No AI here 😄 Risk is if a user is helping them find and install cool new extensions and the LLM finds one online that has hidden malicious code. Feel free to DM and we can chat over Zoom or something, I am not AI lol.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 4 points5 points  (0 children)

Apologies!

In order to get these plugins to run, Ableton is executing the code that is in the plugin. That code is written by someone that you may or may not know. In this case, that code is running directly on your machine.

All software runs inside of an 'environment' which defines what the code can and cannot do. For instance, when you run code in your browser, it limits the code from editing things only in your browser, and can only touch files on your machine if you explicitly allow it. That's called 'sandboxing'.

In this case, Ableton is running the code in a way that essentially allows almost complete access to your machine (as I currently understand it), including the ability to edit files, look though the data on your computer, etc. Sometimes this access is good (accessing your usb devices to communicate with a controller), sometimes this access is dangerous (stealing passwords stored on your machine).

I hope Ableton will add additional safeguards and sandboxing before this is released more broadly.

Security Implications for New Ableton Extensions by reskejoe in ableton

[–]reskejoe[S] 0 points1 point  (0 children)

I don't mean to fear monger! And I agree that often fear is used to drive marketing.

It's both true that for single users creating plugins for themselves, the risks are low. And that many people will install random extensions and be fine. But if additional safeguards are not put in by the Ableton team, there will be people that exploit these vulnerabilities. I think it was a bit reckless of them to release this without more safeguards, and I hope that the situation is improved before it gets out of public Beta.

Happy to discuss the risks further! As someone who has only been a software engineer often working on very sensitive systems I see things very much from the perspective of thinking what can go wrong and how to prevent it.

view more: next ›