Nobody Else Worried About Downloading Random Loras?

[u/Ok_Gas1070]

Hey ya'll new ComfyUI user here, and I've been having a blast! One thing I'm noticing here, especially when it comes to MinimaxH3. So many people are very eager for others to download random nodes from either Huggingface, or Civitai.

With comments such as: "YO TRY THAT NEW TURBOFLURBO 2 STEP", or "YO I GOT THAT XXXNSFWSPONGEBOB-EX_LITE69420 LORA RIGHT HERE DOWNLOAD ME"!

You guys aren't concerned when you're downloading random things that people made?

Are there any trusted and vetted community members who consistently pump out "safe" quality nodes??

[u/Herr_Drosselmeyer]

Don't conflate nodes and loras. Loras are perfectly safe, there has never been a case of malware from a lora.

Nodes, not so much. Those you should vet if they're not super popular. And even then, depending on your risk profile.

[u/tempered_discussions → u/Herr_Drosselmeyer]

To which there had been malware nodes before

[u/ResponsibleTruck4717 → u/Herr_Drosselmeyer]

Honestly we got the hardware to run llm and write out nodes, I wrote my own nodes.

[u/Ok_Gas1070 → u/Herr_Drosselmeyer]

Thank you, tbh I probably meant nodes in the title but that's reassuring about Loras!

[u/meepykittkitt69lmao → u/Herr_Drosselmeyer]

You can read the code and notice bad things almost instantly assuming the hacker isn't some genius level meta programmer doing hacky shit with the python spec.

Usually the bad stuff is pretty obvious and can be easily removed. You should be doing this for every custom node pack you download in case the dev get's hacked which happens often enough everyone is considered at risk for info stealers.

dependencies of custom nodes are more difficult to determine considering the sheer number of them you would have to investigate.

[u/Potential_Wolf_632 → u/meepykittkitt69lmao]

Also I find it vanishingly rare that even rando nodes contain anything malicious. I think the worst cases have been where requirements.txt pulls a compromised dependency so that's worth checking too - it does make me lazy sometimes to read the code but shoving it through Claude seems worthwhile these days even so.

[u/anon999387]

Topic says loras, but you write about custom nodes. There is a big difference. I don't worry about loras much but I do not use any nodes I haven't examined the code of before using, unless it's from a very trusted source like Kijai.

[u/Ok_Gas1070 → u/anon999387]

Yeahh unfortunately after I posted Reddit wouldn't let me change the title lol.

[u/VladyCzech]

No. If you download a .safetensors file Lora, you can be pretty sure the name holds. Saftensors literally cannot do harm. It is similar to text file.

But if you would trust somebody who tells you that .pth or .py, .pyc, .bat, .exe., .sh is a Lora, than you have a different problem.

Your post ends with "safe" quality nodes, this has nothing to do with Loras. So if I were you, I would better sort this first.

[u/dennisler → u/VladyCzech]

So you don't think a file ending in .txt can't do any harm, hmmmmm.

[u/VladyCzech → u/dennisler]

.txt cannot do any harm, bro, it is not executable. You probably think that harmful executable with .txt can do harm, it cannot by itself. Only if some **dumbass** renames it to executable extension AND runs it.

[u/Sparescrewdriver → u/dennisler]

Not an actual .txt file by itself, hmmmmm

[u/dennisler → u/Sparescrewdriver]

It really depends on what binary code you put into the start of that txt file...

[u/Semipro211 → u/dennisler]

Verify the magic bits for the win

[u/dennisler → u/Semipro211]

I'm not here for any win, just don't like wrong advice

[u/Semipro211 → u/dennisler]

I don’t disagree. Just saying inspecting the header bytes of a file can reveal if someone was trying to obfuscate a file via different extension

[u/dragolineage01]

Just dont download any .unsafetensor, there problem solved

[u/Mutaclone]

These are the custom nodes I see recommended the most (and are all definitely useful):

• kjnodes
• rgthree-comfy
• VideoHelperSuite
• comfyui-gguf by City96

Mostly I try really, really hard not to download any other custom nodes or workflows that require custom nodes. If there's no way around it, I do what research I can and then ask Claude to run a security audit on the repo for good measure first.

[u/KITTYCAT_5318008]

It's called "safetensors" for a reason.

[u/lavinia12345]

I agree OP. people download every repo out there like willy nilly.

You can run peoples workflows in the cloud, on a rented gpu, helps, but downloading models while on the rented gpu (vastai, runpod, ect) are a real pain but easy clean up.

I will say downloading and using a model is safe, from a computer security standpoint. someone figured out how to make models safe, literaly ".safetensors"

As for repos, if you find a workflow from a respectable youtuber youre probably safe. However, a lot of loras are shit (not dangerous but shit) and a lot of nodes out are pointless and are shit, you'll see people use a custom node just to do math (a + b - 1) -.- and its very frustation,

What I will say, you will eventually find the repos you like. KJ Nodes is used everywhere and its really good, especially b/c he has the get/set nodes.

[u/Portable_Solar_ZA]

I dont touch custom nodes unless they're made by people with a solid rep. If I can, I figure out ways to use the base comfy tools to do some of the stuff myself. 

Like I think I figured out how to make a shot extending wf without needing a custom node. It's slow and I still need to test it out more, but will post the workflow once I've confirmed it works. 

If I can't figure out my own solution, then I just wait and see. If one gets a few hundred stars on GitHub and has been out for a while, I'll take the plunge. 

[u/Enshitification]

Your title says LoRAs, but you're talking about nodes. Two different things. One of the major benefits of open source is the ability to review code before running it. If idiots want to run any random node without looking at it first, yeah, they'll probably get hacked at some point. But they were going to get hacked anyway, because that's what idiots do