Security note for Buzz 1.4.5

[raivisdejus]

If you start recording transcriber with whisper.cpp the Buzz 1.4.5 will start an internal transcription server on port 3003. In version 1.4.5 this server port will be available on your external IP as well, so possibly available to computers on your local network or even public internet. Technically a malicious actor can use this to interfere with your transcription process or overload your system with junk requests.

The port 3003 is exposed only while recording transcriber is running, only with whisper.cpp and only in version 1.4.5.

Real world risk of this having adverse effect I value as low and highly unlikely to affect anyone, but if this is a concern for you, here are some options of resolving the issue:

• Update to latest development version
• Downgrade to 1.4.4 available on sourceforge or releases section
• Add firewall rule blocking public access to port 3003

Thanks @router0mail for reporting this.