github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-05-06 19:08:59 -05:00
Code Issues 1.3k Packages Projects Releases 126 Wiki Activity

[GH-ISSUE #1302] audit: external connection #27965

New Issue
Closed
opened 2026-04-25 02:44:07 -05:00 by GiteaMirror · 12 comments
GiteaMirror commented 2026-04-25 02:44:07 -05:00
Owner
Copy Link

Originally created by @demesm on GitHub (Mar 26, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/1302

What is the purpose of this connection to a remote ip?

image
Originally created by @demesm on GitHub (Mar 26, 2024). Original GitHub issue: https://github.com/open-webui/open-webui/issues/1302 What is the purpose of this connection to a remote ip? <img width="699" alt="image" src="https://github.com/open-webui/open-webui/assets/23346713/17ffe2a6-db44-496b-92b8-8beaccee68ab">
GiteaMirror commented 2026-04-25 02:44:08 -05:00
Author
Owner
Copy Link

@Darin755 commented on GitHub (Mar 26, 2024):

This is fairly concerning. This project has the potential to allow people to actually have privacy while using AI but some of the design choices do not seem to focus on privacy.

<!-- gh-comment-id:2019276808 --> @Darin755 commented on GitHub (Mar 26, 2024): This is fairly concerning. This project has the potential to allow people to actually have privacy while using AI but some of the design choices do not seem to focus on privacy.
GiteaMirror commented 2026-04-25 02:44:08 -05:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Mar 26, 2024):

Related #807, To reiterate, WebUI does not make any external connections in operation and everything stays on your machine. Don't trust our word for it; We encourage you to examine/audit our code, and make a PR in case we missed anything. We would not have open-sourced the project if we wanted to be shady about the data collection policy.

We would also love to know what part of the code is making this connection, if I had to make an educated guess based on the precedented issue reports, it seems like one of our dependency libraries upstream is making the connection. Feel free to continue your investigation and keep us updated!

<!-- gh-comment-id:2019331639 --> @tjbck commented on GitHub (Mar 26, 2024): Related #807, To reiterate, WebUI does not make any external connections in operation and everything stays on your machine. **Don't trust our word for it; We encourage you to examine/audit our code, and make a PR in case we missed anything.** We would not have open-sourced the project if we wanted to be shady about the data collection policy. We would also love to know what part of the code is making this connection, if I had to make an educated guess based on the precedented issue reports, it seems like one of our dependency libraries upstream is making the connection. Feel free to continue your investigation and keep us updated!
GiteaMirror commented 2026-04-25 02:44:08 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Mar 26, 2024):

I've intended to communicate my experience in this regard eventually and this ticket is a good opportunity. To date, I've almost exclusively used the Docker container with Podman (self-built and official download). I think I've adequately identified the source of all external network connections I've encountered, which all appear to be entirely legitimate. I've also not yet found anything suspicious in the source code of this project or dependencies (granted I've not performed a full audit 😀 but my first pull request was quickly implemented to disable Chroma telemetry #618).

Note that the Dockerfile explicitly attempts to preload models for Whisper and Chroma embedding (via sentence_transformers) during the build process. In my experience, the containers function entirely offline with a startup delay (this is a topic for another discussion and IMHO a ticket is warranted). You can now use the GLOBAL_LOG_LEVEL="DEBUG" environment variable to get a deeper glimpse.

Here are my notes:

Connections

  • huggingface.co: sentence_transformer (RAG)

Connection initiated here:

Mar 26 01:30:58 hostname open-webui[305428]: INFO:sentence_transformers.SentenceTransformer:Load pretrained SentenceTransformer: all-MiniLM-L6-v2
Mar 26 01:30:58 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): huggingface.co:443

There seems to be a problem with SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache/embedding/models somewhere that appears to result in execution of hf_hub_download() at this point

Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config_sentence_transformers.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/README.md HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/sentence_bert_config.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/tokenizer_config.json HTTP/1.1" 200 0
Mar 26 01:31:01 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "GET /api/models/sentence-transformers/all-MiniLM-L6-v2/revision/main HTTP/1.1" 200 18778
  • raw.githubusercontent.com: litellm

It seems that litellm make a compulsory connection to download this file. Use of LITELLM_LOCAL_MODEL_COST_MAP may be a reasonable mitigation. Testing should be easy enough.

Mar 26 01:30:57 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://raw.githubusercontent.com:443 "GET /BerriAI/litellm/main/model_prices_and_context_window.json HTTP/1.1" 200 5064
  • api.github.com: Open-WebUI update check
Mar 26 01:35:19 hostname open-webui[305428]: INFO:     10.0.2.100:56500 - "GET /ollama/api/version HTTP/1.1" 200 OK
Mar 26 01:35:19 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.github.com:443
Mar 26 01:35:19 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://api.github.com:443 "GET /repos/open-webui/open-webui/releases/latest HTTP/1.1" 200 1070
Mar 26 01:35:19 hostname open-webui[305428]: INFO:     10.0.2.100:56500 - "GET /api/version/updates HTTP/1.1" 200 OK

Gravatar is also incorporated but I've yet to encounter any related traffic perhaps due to my choice of invalid email addresses that I use with my Open-WebUI accounts.

Of course connections to OpenAI and anywhere else like MistralAI will occur if desired and configured appropriately.

<!-- gh-comment-id:2020013023 --> @ghost commented on GitHub (Mar 26, 2024): I've intended to communicate my experience in this regard eventually and this ticket is a good opportunity. To date, I've almost exclusively used the Docker container with Podman (self-built and official download). I think I've adequately identified the source of all external network connections I've encountered, which all appear to be entirely legitimate. I've also not yet found anything suspicious in the source code of this project or dependencies (granted I've not performed a full audit 😀 but my first pull request was quickly implemented to disable Chroma telemetry #618). Note that the [Dockerfile explicitly attempts to preload models for Whisper and Chroma embedding (via sentence_transformers) during the build process](https://github.com/open-webui/open-webui/blob/ac294a74e7bc5f080970c049c656506e36f9407b/Dockerfile#L67). In my experience, the containers function entirely offline with a startup delay (this is a topic for another discussion and IMHO a ticket is warranted). You can now use the `GLOBAL_LOG_LEVEL="DEBUG"` environment variable to get a deeper glimpse. Here are my notes: ### Connections - _huggingface.co_: sentence_transformer (RAG) Connection initiated [here](https://github.com/UKPLab/sentence-transformers/blob/1e35d8c159ea4fcb9253d5d680480ba475cf81b8/sentence_transformers/SentenceTransformer.py#L107): ``` Mar 26 01:30:58 hostname open-webui[305428]: INFO:sentence_transformers.SentenceTransformer:Load pretrained SentenceTransformer: all-MiniLM-L6-v2 Mar 26 01:30:58 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): huggingface.co:443 ``` There seems to be a problem with `SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache/embedding/models` [somewhere](https://github.com/UKPLab/sentence-transformers/blob/737353354fbdf1a419eee864f998ffe9fdf3b682/sentence_transformers/SentenceTransformer.py#L104) that appears to result in execution of `hf_hub_download()` at [this point](https://github.com/UKPLab/sentence-transformers/blob/737353354fbdf1a419eee864f998ffe9fdf3b682/sentence_transformers/util.py#L532) ``` Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0 Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config_sentence_transformers.json HTTP/1.1" 200 0 Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/README.md HTTP/1.1" 200 0 Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0 Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/sentence_bert_config.json HTTP/1.1" 200 0 Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config.json HTTP/1.1" 200 0 Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/tokenizer_config.json HTTP/1.1" 200 0 Mar 26 01:31:01 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "GET /api/models/sentence-transformers/all-MiniLM-L6-v2/revision/main HTTP/1.1" 200 18778 ``` - _raw.githubusercontent.com_: litellm It seems that litellm make a compulsory connection to [download](https://github.com/BerriAI/litellm/blob/995c379a63d0bb9760a9e507c06a058ce3c28cb7/litellm/__init__.py#L229) this [file](https://github.com/BerriAI/litellm/blob/995c379a63d0bb9760a9e507c06a058ce3c28cb7/litellm/__init__.py#L165). Use of [LITELLM_LOCAL_MODEL_COST_MAP](https://github.com/BerriAI/litellm/blob/995c379a63d0bb9760a9e507c06a058ce3c28cb7/litellm/__init__.py#L199) may be a reasonable mitigation. Testing should be easy enough. ``` Mar 26 01:30:57 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://raw.githubusercontent.com:443 "GET /BerriAI/litellm/main/model_prices_and_context_window.json HTTP/1.1" 200 5064 ``` - _api.github.com_: Open-WebUI update check ``` Mar 26 01:35:19 hostname open-webui[305428]: INFO: 10.0.2.100:56500 - "GET /ollama/api/version HTTP/1.1" 200 OK Mar 26 01:35:19 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.github.com:443 Mar 26 01:35:19 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://api.github.com:443 "GET /repos/open-webui/open-webui/releases/latest HTTP/1.1" 200 1070 Mar 26 01:35:19 hostname open-webui[305428]: INFO: 10.0.2.100:56500 - "GET /api/version/updates HTTP/1.1" 200 OK ``` Gravatar is also incorporated but I've yet to encounter any related traffic perhaps due to my choice of invalid email addresses that I use with my Open-WebUI accounts. Of course connections to OpenAI and anywhere else like MistralAI will occur if desired and configured appropriately.
GiteaMirror commented 2026-04-25 02:44:10 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Mar 26, 2024):

What is the purpose of this connection to a remote ip?

This IP resolves to a CloudFront Philadelphia address:

$ host 18.238.4.28
28.4.238.18.in-addr.arpa domain name pointer server-18-238-4-28.phl51.r.cloudfront.net.

I'd wager that this is a Huggingface endoint.

$ whois 18.238.4.28
ARIN WHOIS data 
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2024, American Registry for Internet Numbers, Ltd.
#



# start

NetRange:       18.32.0.0 - 18.255.255.255
CIDR:           18.128.0.0/9, 18.64.0.0/10, 18.32.0.0/11
NetName:        AT-88-Z
NetHandle:      NET-18-32-0-0-1
Parent:         NET18 (NET-18-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       
Organization:   Amazon Technologies Inc. (AT-88-Z)
RegDate:        2019-10-07
Updated:        2021-02-10
Ref:            https://rdap.arin.net/registry/ip/18.32.0.0



OrgName:        Amazon Technologies Inc.
OrgId:          AT-88-Z
Address:        410 Terry Ave N.
City:           Seattle
StateProv:      WA
PostalCode:     98109
Country:        US
RegDate:        2011-12-08
Updated:        2024-01-24
Comment:        All abuse reports MUST include:
Comment:        * src IP
Comment:        * dest IP (your IP)
Comment:        * dest port
Comment:        * Accurate date/timestamp and timezone of activity
Comment:        * Intensity/frequency (short log extracts)
Comment:        * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time.
Ref:            https://rdap.arin.net/registry/entity/AT-88-Z


OrgRoutingHandle: IPROU3-ARIN
OrgRoutingName:   IP Routing
OrgRoutingPhone:  +1-206-555-0000 
OrgRoutingEmail:  aws-routing-poc@amazon.com
OrgRoutingRef:    https://rdap.arin.net/registry/entity/IPROU3-ARIN

OrgNOCHandle: AANO1-ARIN
OrgNOCName:   Amazon AWS Network Operations
OrgNOCPhone:  +1-206-555-0000 
OrgNOCEmail:  amzn-noc-contact@amazon.com
OrgNOCRef:    https://rdap.arin.net/registry/entity/AANO1-ARIN

OrgTechHandle: ANO24-ARIN
OrgTechName:   Amazon EC2 Network Operations
OrgTechPhone:  +1-206-555-0000 
OrgTechEmail:  amzn-noc-contact@amazon.com
OrgTechRef:    https://rdap.arin.net/registry/entity/ANO24-ARIN

OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-555-0000 
OrgAbuseEmail:  abuse@amazonaws.com
OrgAbuseRef:    https://rdap.arin.net/registry/entity/AEA8-ARIN

OrgRoutingHandle: ARMP-ARIN
OrgRoutingName:   AWS RPKI Management POC
OrgRoutingPhone:  +1-206-555-0000 
OrgRoutingEmail:  aws-rpki-routing-poc@amazon.com
OrgRoutingRef:    https://rdap.arin.net/registry/entity/ARMP-ARIN

# end


# start

NetRange:       18.238.0.0 - 18.239.255.255
CIDR:           18.238.0.0/15
NetName:        AMAZON-CF
NetHandle:      NET-18-238-0-0-1
Parent:         AT-88-Z (NET-18-32-0-0-1)
NetType:        Reallocated
OriginAS:       
Organization:   Amazon.com, Inc. (AMAZON-4)
RegDate:        2022-01-21
Updated:        2022-01-21
Ref:            https://rdap.arin.net/registry/ip/18.238.0.0



OrgName:        Amazon.com, Inc.
OrgId:          AMAZON-4
Address:        1918 8th Ave
City:           SEATTLE
StateProv:      WA
PostalCode:     98101-1244
Country:        US
RegDate:        1995-01-23
Updated:        2022-09-30
Ref:            https://rdap.arin.net/registry/entity/AMAZON-4


OrgTechHandle: ANO24-ARIN
OrgTechName:   Amazon EC2 Network Operations
OrgTechPhone:  +1-206-555-0000 
OrgTechEmail:  amzn-noc-contact@amazon.com
OrgTechRef:    https://rdap.arin.net/registry/entity/ANO24-ARIN

OrgRoutingHandle: IPROU3-ARIN
OrgRoutingName:   IP Routing
OrgRoutingPhone:  +1-206-555-0000 
OrgRoutingEmail:  aws-routing-poc@amazon.com
OrgRoutingRef:    https://rdap.arin.net/registry/entity/IPROU3-ARIN

OrgRoutingHandle: ARMP-ARIN
OrgRoutingName:   AWS RPKI Management POC
OrgRoutingPhone:  +1-206-555-0000 
OrgRoutingEmail:  aws-rpki-routing-poc@amazon.com
OrgRoutingRef:    https://rdap.arin.net/registry/entity/ARMP-ARIN

OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-555-0000 
OrgAbuseEmail:  abuse@amazonaws.com
OrgAbuseRef:    https://rdap.arin.net/registry/entity/AEA8-ARIN

OrgNOCHandle: AANO1-ARIN
OrgNOCName:   Amazon AWS Network Operations
OrgNOCPhone:  +1-206-555-0000 
OrgNOCEmail:  amzn-noc-contact@amazon.com
OrgNOCRef:    https://rdap.arin.net/registry/entity/AANO1-ARIN

# end



#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2024, American Registry for Internet Numbers, Ltd.
#
<!-- gh-comment-id:2020037999 --> @ghost commented on GitHub (Mar 26, 2024): > What is the purpose of this connection to a remote ip? This IP resolves to a CloudFront Philadelphia address: ``` $ host 18.238.4.28 28.4.238.18.in-addr.arpa domain name pointer server-18-238-4-28.phl51.r.cloudfront.net. ``` I'd wager that this is a Huggingface endoint. ``` $ whois 18.238.4.28 ``` <details> <summary>ARIN WHOIS data</summary> ``` # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/resources/registry/whois/tou/ # # If you see inaccuracies in the results, please report at # https://www.arin.net/resources/registry/whois/inaccuracy_reporting/ # # Copyright 1997-2024, American Registry for Internet Numbers, Ltd. # # start NetRange: 18.32.0.0 - 18.255.255.255 CIDR: 18.128.0.0/9, 18.64.0.0/10, 18.32.0.0/11 NetName: AT-88-Z NetHandle: NET-18-32-0-0-1 Parent: NET18 (NET-18-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Amazon Technologies Inc. (AT-88-Z) RegDate: 2019-10-07 Updated: 2021-02-10 Ref: https://rdap.arin.net/registry/ip/18.32.0.0 OrgName: Amazon Technologies Inc. OrgId: AT-88-Z Address: 410 Terry Ave N. City: Seattle StateProv: WA PostalCode: 98109 Country: US RegDate: 2011-12-08 Updated: 2024-01-24 Comment: All abuse reports MUST include: Comment: * src IP Comment: * dest IP (your IP) Comment: * dest port Comment: * Accurate date/timestamp and timezone of activity Comment: * Intensity/frequency (short log extracts) Comment: * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time. Ref: https://rdap.arin.net/registry/entity/AT-88-Z OrgRoutingHandle: IPROU3-ARIN OrgRoutingName: IP Routing OrgRoutingPhone: +1-206-555-0000 OrgRoutingEmail: aws-routing-poc@amazon.com OrgRoutingRef: https://rdap.arin.net/registry/entity/IPROU3-ARIN OrgNOCHandle: AANO1-ARIN OrgNOCName: Amazon AWS Network Operations OrgNOCPhone: +1-206-555-0000 OrgNOCEmail: amzn-noc-contact@amazon.com OrgNOCRef: https://rdap.arin.net/registry/entity/AANO1-ARIN OrgTechHandle: ANO24-ARIN OrgTechName: Amazon EC2 Network Operations OrgTechPhone: +1-206-555-0000 OrgTechEmail: amzn-noc-contact@amazon.com OrgTechRef: https://rdap.arin.net/registry/entity/ANO24-ARIN OrgAbuseHandle: AEA8-ARIN OrgAbuseName: Amazon EC2 Abuse OrgAbusePhone: +1-206-555-0000 OrgAbuseEmail: abuse@amazonaws.com OrgAbuseRef: https://rdap.arin.net/registry/entity/AEA8-ARIN OrgRoutingHandle: ARMP-ARIN OrgRoutingName: AWS RPKI Management POC OrgRoutingPhone: +1-206-555-0000 OrgRoutingEmail: aws-rpki-routing-poc@amazon.com OrgRoutingRef: https://rdap.arin.net/registry/entity/ARMP-ARIN # end # start NetRange: 18.238.0.0 - 18.239.255.255 CIDR: 18.238.0.0/15 NetName: AMAZON-CF NetHandle: NET-18-238-0-0-1 Parent: AT-88-Z (NET-18-32-0-0-1) NetType: Reallocated OriginAS: Organization: Amazon.com, Inc. (AMAZON-4) RegDate: 2022-01-21 Updated: 2022-01-21 Ref: https://rdap.arin.net/registry/ip/18.238.0.0 OrgName: Amazon.com, Inc. OrgId: AMAZON-4 Address: 1918 8th Ave City: SEATTLE StateProv: WA PostalCode: 98101-1244 Country: US RegDate: 1995-01-23 Updated: 2022-09-30 Ref: https://rdap.arin.net/registry/entity/AMAZON-4 OrgTechHandle: ANO24-ARIN OrgTechName: Amazon EC2 Network Operations OrgTechPhone: +1-206-555-0000 OrgTechEmail: amzn-noc-contact@amazon.com OrgTechRef: https://rdap.arin.net/registry/entity/ANO24-ARIN OrgRoutingHandle: IPROU3-ARIN OrgRoutingName: IP Routing OrgRoutingPhone: +1-206-555-0000 OrgRoutingEmail: aws-routing-poc@amazon.com OrgRoutingRef: https://rdap.arin.net/registry/entity/IPROU3-ARIN OrgRoutingHandle: ARMP-ARIN OrgRoutingName: AWS RPKI Management POC OrgRoutingPhone: +1-206-555-0000 OrgRoutingEmail: aws-rpki-routing-poc@amazon.com OrgRoutingRef: https://rdap.arin.net/registry/entity/ARMP-ARIN OrgAbuseHandle: AEA8-ARIN OrgAbuseName: Amazon EC2 Abuse OrgAbusePhone: +1-206-555-0000 OrgAbuseEmail: abuse@amazonaws.com OrgAbuseRef: https://rdap.arin.net/registry/entity/AEA8-ARIN OrgNOCHandle: AANO1-ARIN OrgNOCName: Amazon AWS Network Operations OrgNOCPhone: +1-206-555-0000 OrgNOCEmail: amzn-noc-contact@amazon.com OrgNOCRef: https://rdap.arin.net/registry/entity/AANO1-ARIN # end # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/resources/registry/whois/tou/ # # If you see inaccuracies in the results, please report at # https://www.arin.net/resources/registry/whois/inaccuracy_reporting/ # # Copyright 1997-2024, American Registry for Internet Numbers, Ltd. # ``` </details>
GiteaMirror commented 2026-04-25 02:44:11 -05:00
Author
Owner
Copy Link

@Darin755 commented on GitHub (Mar 26, 2024):

Maybe you could add a environment variable that explicitly tells it to connect to the internet? This could be added to the getting started command and those who do not want third party services for privacy reasons could simply remove the variables.

My initial comment was probably way to harsh but I have noticed that some projects simply do not focus on privacy or ethical issues. That does not make them malicious but is usually a byproduct of the developers not caring about privacy.

<!-- gh-comment-id:2021109145 --> @Darin755 commented on GitHub (Mar 26, 2024): Maybe you could add a environment variable that explicitly tells it to connect to the internet? This could be added to the getting started command and those who do not want third party services for privacy reasons could simply remove the variables. My initial comment was probably way to harsh but I have noticed that some projects simply do not focus on privacy or ethical issues. That does not make them malicious but is usually a byproduct of the developers not caring about privacy.
GiteaMirror commented 2026-04-25 02:44:11 -05:00
Author
Owner
Copy Link

@justinh-rahb commented on GitHub (Mar 26, 2024):

Thanks @lainedfles for the thorough analysis! The part you noted here probably should be looked into @tjbck:

There seems to be a problem with SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache/embedding/models somehwere that appears to result in in execution of hf_hub_download() at this point

Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config_sentence_transformers.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/README.md HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/sentence_bert_config.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config.json HTTP/1.1" 200 0
Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/tokenizer_config.json HTTP/1.1" 200 0
Mar 26 01:31:01 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "GET /api/models/sentence-transformers/all-MiniLM-L6-v2/revision/main HTTP/1.1" 200 18778

And yes, Gravatar shouldn't be fetched unless you want it to be used by setting so in your profile settings.

Gravatar is also incorporated but I've yet to encounter any related traffic perhaps due to my choice of invalid email addresses that I use with my Open-WebUI accounts.

<!-- gh-comment-id:2021117409 --> @justinh-rahb commented on GitHub (Mar 26, 2024): Thanks @lainedfles for the thorough analysis! The part you noted here probably should be looked into @tjbck: > There seems to be a problem with `SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache/embedding/models` [somehwere](https://github.com/UKPLab/sentence-transformers/blob/737353354fbdf1a419eee864f998ffe9fdf3b682/sentence_transformers/SentenceTransformer.py#L104) that appears to result in in execution of `hf_hub_download()` at [this point](https://github.com/UKPLab/sentence-transformers/blob/737353354fbdf1a419eee864f998ffe9fdf3b682/sentence_transformers/util.py#L532) > > ``` > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0 > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config_sentence_transformers.json HTTP/1.1" 200 0 > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/README.md HTTP/1.1" 200 0 > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json HTTP/1.1" 200 0 > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/sentence_bert_config.json HTTP/1.1" 200 0 > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/config.json HTTP/1.1" 200 0 > Mar 26 01:31:00 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "HEAD /sentence-transformers/all-MiniLM-L6-v2/resolve/main/tokenizer_config.json HTTP/1.1" 200 0 > Mar 26 01:31:01 hostname open-webui[305428]: DEBUG:urllib3.connectionpool:https://huggingface.co:443 "GET /api/models/sentence-transformers/all-MiniLM-L6-v2/revision/main HTTP/1.1" 200 18778 > ``` > And yes, Gravatar shouldn't be fetched unless you want it to be used by setting so in your profile settings. > Gravatar is also incorporated but I've yet to encounter any related traffic perhaps due to my choice of invalid email addresses that I use with my Open-WebUI accounts.
GiteaMirror commented 2026-04-25 02:44:12 -05:00
Author
Owner
Copy Link

@justinh-rahb commented on GitHub (Mar 26, 2024):

My initial comment was probably way to harsh but I have noticed that some projects simply do not focus on privacy or ethical issues. That does not make them malicious but is usually a byproduct of the developers not caring about privacy.

We've a documented history of taking these matters seriously, but we also rely on others to find and report this stuff. Thank you to everyone for keeping an eye on things. We do try to find this stuff early, but sometimes things get snuck in after they were originally merged.

<!-- gh-comment-id:2021123246 --> @justinh-rahb commented on GitHub (Mar 26, 2024): > My initial comment was probably way to harsh but I have noticed that some projects simply do not focus on privacy or ethical issues. That does not make them malicious but is usually a byproduct of the developers not caring about privacy. We've a documented history of taking these matters seriously, but we also rely on others to find and report this stuff. Thank you to everyone for keeping an eye on things. We do try to find this stuff early, but sometimes things get snuck in after they were originally merged.
GiteaMirror commented 2026-04-25 02:44:13 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Apr 5, 2024):

I've confirmed that --env LITELLM_LOCAL_MODEL_COST_MAP="True" successfully eliminates the LiteLLM startup connection. When used along with #1419, there are no connections on startup except for your configured LLM models (in my case localhost for Ollama). The Open-WebUI update check still must be manually triggered via the Settings -> About page. Offline startup is MUCH faster!

<!-- gh-comment-id:2039091310 --> @ghost commented on GitHub (Apr 5, 2024): I've confirmed that `--env LITELLM_LOCAL_MODEL_COST_MAP="True"` successfully eliminates the LiteLLM startup connection. When used along with #1419, there are no connections on startup except for your configured LLM models (in my case localhost for Ollama). The Open-WebUI update check still must be manually triggered via the Settings -> About page. Offline startup is MUCH faster!
GiteaMirror commented 2026-04-25 02:44:13 -05:00
Author
Owner
Copy Link

@Darin755 commented on GitHub (Apr 5, 2024):

I've confirmed that --env LITELLM_LOCAL_MODEL_COST_MAP="True" successfully eliminates the LiteLLM startup connection. When used along with #1419, there are no connections on startup except for your configured LLM models (in my case localhost for Ollama). The Open-WebUI update check still must be manually triggered via the Settings -> About page. Offline startup is MUCH faster!

It might be worth making this the default

<!-- gh-comment-id:2040487590 --> @Darin755 commented on GitHub (Apr 5, 2024): > I've confirmed that `--env LITELLM_LOCAL_MODEL_COST_MAP="True"` successfully eliminates the LiteLLM startup connection. When used along with #1419, there are no connections on startup except for your configured LLM models (in my case localhost for Ollama). The Open-WebUI update check still must be manually triggered via the Settings -> About page. Offline startup is MUCH faster! It might be worth making this the default
GiteaMirror commented 2026-04-25 02:44:13 -05:00
Author
Owner
Copy Link

@justinh-rahb commented on GitHub (Apr 5, 2024):

I've confirmed that --env LITELLM_LOCAL_MODEL_COST_MAP="True" successfully eliminates the LiteLLM startup connection. When used along with #1419, there are no connections on startup except for your configured LLM models (in my case localhost for Ollama). The Open-WebUI update check still must be manually triggered via the Settings -> About page. Offline startup is MUCH faster!

Nice one @lainedfles !

<!-- gh-comment-id:2040494483 --> @justinh-rahb commented on GitHub (Apr 5, 2024): > I've confirmed that `--env LITELLM_LOCAL_MODEL_COST_MAP="True"` successfully eliminates the LiteLLM startup connection. When used along with #1419, there are no connections on startup except for your configured LLM models (in my case localhost for Ollama). The Open-WebUI update check still must be manually triggered via the Settings -> About page. Offline startup is MUCH faster! Nice one @lainedfles !
GiteaMirror commented 2026-04-25 02:44:14 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Apr 5, 2024):

It might be worth making this the default

@Darin755 I agree! PR created: #1436

Nice one @lainedfles !

@justinh-rahb Thanks, I'm having a lot of fun with this project, it's fast becoming a new hobby! Thank you for all your knowledge and support.

<!-- gh-comment-id:2040720877 --> @ghost commented on GitHub (Apr 5, 2024): > It might be worth making this the default @Darin755 I agree! PR created: #1436 > Nice one @lainedfles ! @justinh-rahb Thanks, I'm having a lot of fun with this project, it's fast becoming a new hobby! Thank you for all your knowledge and support.
GiteaMirror commented 2026-04-25 02:44:14 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Apr 11, 2024):

Found another HuggingFace connection to download the WhisperModel. See #1499

<!-- gh-comment-id:2048836767 --> @ghost commented on GitHub (Apr 11, 2024): Found another HuggingFace connection to download the WhisperModel. See #1499
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#27965
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?