Basically, you can download anything inside of ComfyUI that is malicious masquerading as “THE BEST PHOTO EDITOR” on Github.
Spot on
Interesting story.
What is most fascinating is the 1Password angle. I’m sure many of us here use this tool. Of course if you can crack that, it’s game over. The specific attack angle is not super clear from the story though.
Also, this is a guy that worked at Disney. That put him high on the target list for a socially engineered attack ComfyUI or otherwise. Anyone working at/for/with a high value company like Disney needs next level security either way.
Most of my high value accounts are secured with a YubiKey for this reason. And I’ve turned off SMS MFA for those accounts. It’s a cat-and-mouse game though where you need to lock things down but keep enough redundancy that you don’t lock yourself out entirely. A thin needle to thread.
One way of sandboxing 1Password (don’t have it on the system) without having to type endless passwords by hand, is keep 1Password on another system, and screenshare via Parsec/VNC anytime you have to enter a password. So you can copy/paste individual passwords without maintaining the vault on a possibly vulnerable system.
It’s also just a danger in the ecosystem of constantly telling everyone keep up or get left behind! without providing any necessary workflows, documentation, or oversight. I feel like the scramble to adopt all of this and the fear that many individuals have across many industries to prove that they’re using AI in some form or another to impress the people up top and have some kind of feeling, grasping and fleeting as it might actually be, of remaining current with a bleeding edge workflow without being adept at cybersecurity creates an incredibly fertile hunting ground for all forms of malicious actors.
Very true. It’s in a mindless moment of rush that even the most thoughtful people get tripped up. About 6 months ago there was a story of a security expert falling victim to an attack for that same reason. He was traveling, he was beyond tired, some other change had just happened, and in fleeting moment of rush he answered the phone and gave away the key.
And this is getting way worse exactly because of AI, because now it doesn’t take much effort to create a detailed dossier about a random person that makes it exceedingly hard to to tell friend from foe.
If hackers could just get honest jobs like all of us, the world would be such a better place. Alas there are always lazy and ruthless people that want to make buck without earning it.
Fun fact, side-loading is the reason why most large studios aren’t allowed to run the logik portal.
They just side load contractors…
Plausible deniability and all that…
If it saves anyone time, here’s a pretty good set of instructions of how to setup a separate user and locking it down for ComfyUI on Rocky Linux 9.3 (i.e your Flame image).
This creates a separate ‘aiuser’, installs Anaconda 3 and ComfyUI and should limit risk from compromised python nodes. Not as good as a totally separate machine, but some level of comfort.
https://claude.ai/share/cd4a7d47-8f53-4776-942b-616ac253058b
If you find Comfy UI intimidating check this channel:
A new tool can always be a bit intimidating.
But from all the ways we could possibly wrap our head around GenAI and all the ML tools, ComfyUI is probably the best thing to happen to Flame artists.
If you peel the onion - it’s essentially a batch group with nodes, there are loaders and savers, there are straight forward nodes like ‘dilate a matte’, and there are opaque processing nodes (like video object remove). There are models to be loaded that can be mysterious, but then when you look at a motion vector cache in Flame, it looks cool, but it too is somewhat opaque in its actual function - having upwards of 12x 32fp data channels, and variable count to boot.
They all have a number of labeled inputs and outputs that you connect with pipes. Different inputs have types, so only like-minded inputs and outputs can be connected. There are elbows to clean up your node graph.
I mean this is all familiar stuff.
The installation is not one-button push, but not any more difficult than installing ML-TW from pre-2025 which lots of us did.
The documentation is a bit scattered, but there are good communities that are building up, just takes a bit to find them. But then Flame’s core documentation isn’t that great either. For the most part you learn Flame by talking to others. And now there’s a learning channel (i.e. the ActionVFX courses, and RunComfy tutorials).
And there are core nodes and then lots of community built nodes akin to our matchboxes.
So all in all, that’s just another day at the office. And it sure beats banging your head at the wall writing prompts in Veo3 and getting frustrated because the result just never is exactly what you need, and you’re not used just telling the computer in your own words what it’s doing wrong.
Hey guys,
Take a look at Weavy.ai I think it’s more flame batch like. Checkout this intro video. The co-founder looks like @fredwarren
Looks interesting.
Be mindful of the depth of development. While not all aspects of ComfyUI have our use cases in mind, there is a tremendous amount of effort and 3rd party nodes that gives it a leg up. And when you get past the initial hurdles, a lot of functions - like mask operations and compositing with blend modes all exist.
Meaning clean ui is only half the battle. At this point of the game velocity and mind share are key advantages. Open source will outrun any startup in this environment.
Hi all
i’m about to enroll, but i’m a bit confused, does anyone know if it’s the same content as upcoming fxphd course from the same Doug? AI Machine Learning Foundations for VFX Artists | fxphd
This one seems like the action vfx one + theory and a bit on gaussian splatting and nerf.
I’ve watched both, quite different focus.
You can join the fxphd talk Discord and ask Doug if you want. We’re having good conversations there.
At my desk now with a more detailed answer to your question:
The ActionVFX course focuses specifically on ComfyUI with lots of resources so you can learn how to use it yourself. You can get there without course using various good YT channels, but Doug provides this with the specific lens of a VFX artists, while many YTer are just generic AI drivers.
The fxphd course he’s making (only the first four of usually 8-10 episodes are posted), and which is rolling out as we speak is focused on the entire AI tool landscape from a VFX point of view. ComfyUI plays a role in this, but is just one part of the puzzle. And the existing episodes are not hands-on workflows, but more theory and roadmap which is still incredibly useful.
In episode 1 John Montgomery (from fxphd) has a long segment on AI model theory which is useful context, and also touches on why some models are less legally tricky than others.
This is what Doug wrote this morning on Discord in a thread on the course. And that exactly mirrors my take away, and why I’m a lot more positive about AI in our small world here than I used to be, while continuing to have significant reservations about the mess OpenAI and Google are creating for humanity at large.
Transcribing since screenshot is hard to read:
Biggest thing I’ve learned so far with using AI tools is just how valuable traditional compositing skills are to get full control. Cleanplating, 2d and 3d tracking, even good old 2d paint work go a LONG way in helping fix issues in an AI generation. And that’s an absolute necessity to get it actually production ready. There’s still no magic button and clients want product accurate, not hallucinations.
I hope younger artists don’t skip on the fundamentals with all these flashy new tools available. They’re super important!
Thanks Jan, i bought the Action VFX one, seems nice indeed. I cannot seem to buy the fxphd one, maybe it’s only on subscription. I’ll go check on the discord, thanks
Yes, fxphd is a subscription. It’s the premiere education resources for VFX and has been for a very long time. Not cheap, totally worth it. And it covers many applications - Flame, Nuke, Houdini, VRay and many more.
I liked the course but I feel it was overpriced. Felt more of a, ActionVFX knows the general state of our industry as a whole and so used FOMO to base what they would charge. Might not have been the sole reason for the basing of the price but was non the less overpriced for the moment we’re in.
There’s actually now another course coming out by Victor Perez which is even pricier. Leveraging his sudo celeb status in VFX and also seems like he based the price off of the Action VFX course.
I get a trying to make a buck vibes from it, again with charging based on FOMO.
I agree with @allklier but actually there is some really good Comfy Youtube channels that are VFX oriented.
CTRL_FX, Alex Villabon are good ones for example.
I feel like one could get a better starting point from the web and Youtube than these courses but the time cost will be much higher. So yeah the course was indeed very helpful given the choices and Doug seems like a good dude.
Also one thing that for some could make the ActionVFX course worth it is a free 60 license of Nuke Studio.
If you’re a freelance Nuke Artist then would be a no brainer even if you never looked at the course… Lol
I think this a good perspective.
It somewhat depends on your background and circumstances. If you’re coming from mostly a studio / staff background, work in established pipelines and are just hedging against the change in trade winds, this is definitely pricey stuff that you didn’t budget for in the past.
Same if you come from a single app background and relied on colleagues and community resources to keep up with developments, then the course seems expensive compared to a LogikLive episode.
There’s nothing wrong with any of this. If it feels expensive then it is. It’s a relative thing.
My background is more complex. I’ve changed careers multiple times, always self-taught. I run my own shop, I work across multiple apps. Being fluent on the latest incarnation of tools and trends is just an essential business expense to me. Time is money, and it’s in my blood at this point. Like many here I’ve had my fxphd subscription for years.
While I do learn a lot via YT videos (I probably have 50+ YT channels in my list), I find a course like this a big time saver. I also like the more targeted engagement with the people teaching these courses. The YT audiences are huge and you’re just part of the noise. With these courses I’ve gotten to know the teachers on fxphd over the years, and met many in person. That can be meaningful.
So it all depends on your perspective. It seems quite a few here have signed up for the course, maybe more than I expected.
Even if you don’t sign up for the course, or think someone used it to make a quick buck (that is definitely a thing), just knowing the general perspective of the course on the future of VFX and AI is in itself a valuable aspect, without having to understand the details of ComfyUI.
Over the years we have seen the ‘learning economy’ as a career backstop. There’s the artists who become realtors when things get slow, and there are some who spin up a course, and find it less stressful than client work. Some of them are really good teachers, and we’re all better for it. Some are not only good teachers, but also community builders (@andymilkis we’re all better for your dedication). Some others should have stayed with the original plan and done better finding clients. And this is a general statement across multiple industries I’ve seen, not a comment on either of the courses or people we are talking about here.
Agreed yes and like I said the time cost is real and the course itself is pretty good and Doug seems like a legit good guy and VFX artist. Hell he learned all this and started using it on jobs initially not me! I mean I took it and liked it and it very much helped.
Just to clarify my perspective:)
When shooting I too started out teaching myself post software and color tools before initially teaching myself Smoke on Mac when it was 1st released. FXPHD was invaluable in that for sure! That and my man @joelosis videos was good enough that I got a little color freelancing in Smoke. As niche a thing as that is.
I then got a staff job and really began to learn Flame properly from the owner and all the super talented freelancers we had coming through our small studio.
So people don’t mis interpret what I’m trying to say. I’m relating things to this literal moment in time for the VFX industry in general(not just Flame artists).
Of course everything is relative for sure but there is a general state of things and many Nuke artist for example are in circumstances that are no longer nearly as favorable shall we say.
I’m definitely in no way criticizing people for taking work in VFX classes and education in general!
I def don’t think that:)
Yes indeed @andymilkis has done great things for the Flame community and I think has shown that sharing knowledge openly can be to the advantage of all. Including to the person sharing the knowledge.
Through his efforts starting Logik Live the knowledge and skill level of a lot of flame artists has been greatly increased in a way I rather like. It’s also helped to maintain and grow a non adversarial openness and strengthening of the Flame community.
Whether here or on Discord the vibes are good and extremely supportive. So I think this is more of the perspective I’m coming from.