61–70 of 369 posts
Interesting that most of the code comments are in English.
Lingua franca with all their contractors most likely.
Also the company always avoided any use of external contractors.
% bzgrep "BEGIN PRIVATE KEY" \*.bz2 disk.tar.bz2:Binary file (standard input) matches drive.tar.bz2:Binary file (standard input) matches extsearch.tar.bz2:Binary file (standard input) matches ...
Though I would expect these keys to be just some stub config values which allowed engineers to quickly run the shit locally.
Earlier quoted context omitted.
Probably Yandex will start watching their infrastructure very closely, and go through all known attack vectors that haven't been prioritized before to fix them ASAP. Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it.
> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. This is naive. This generation seems very sensitive to the prospect of computer crime. The stolen source code will almost certainly be read, and if deemed novel enough will be turned into open source projects. It may be tough to figure out those projects a…
You're right. I remember a time, maybe 20 years ago, when stuff like this would be generally appreciated by any community of hackers.
Earlier quoted context omitted.
> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. This is naive. This generation seems very sensitive to the prospect of computer crime. The stolen source code will almost certainly be read, and if deemed novel enough will be turned into open source projects. It may be tough to figure out those projects a…
>This generation seems very sensitive to the prospect of computer crime. You're right. I remember a time, maybe 20 years ago, when stuff like this would be generally appreciated by any community of hackers.
They do not have memories of a time when people tinkered around doing all kinds of crazy and possibly illegal stuff, just for fun, just to see if the could. Sad really.
What are the short-term and long-term implications of this? I assume a drastically increased attack surface and potentially a boon for open-source development? Anything else?
I expect the code to be mostly worthless. There is just too much of it, it's poorly documented and, oftenly, just badly designed and badly written.
And the actual important data (index shards, voice models, all that crap) is not in these dumps.
Earlier quoted context omitted.
They are still the most popular search engine in Russia, they have the best brand, etc. Intangible stuff like that is hard to copy. Running a search engine on the scale of Yandex is very expensive so I don't think that they are going to be replaced by some startup that copies their code and adds a few features. Probably a bunch of bugs will be found but that's not the end of the world. Apparently they handle images p…
Knowing how stuff like anti-spam algorithms and ranking algorithms work in order to abuse them is probably the much higher value here.
Earlier quoted context omitted.
> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. With the current geopolitical situation going on, is this really true? (From a western developer's perspective)
Even if Russia were at war with the world, it would still be unethical to loot its citizens' property.
Interesting that most of the code comments are in English.
So you can confirm they are legit? Anything look exciting?
Earlier quoted context omitted.
I mean they were pretty much forced to sell business to the government recently. Coincidence? Maybe…
what business and to what government? are you in your dreams?
https://techcrunch.com/2022/09/12/yandex-news-zen-vk-sale-co...
What are the short-term and long-term implications of this? I assume a drastically increased attack surface and potentially a boon for open-source development? Anything else?
Using stolen code in an open-source project seems like a bad idea.