Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Whole Yandex Git repository leaked

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 369 posts

Re: Tell HN: Whole Yandex Git repository leaked

#281

Post by hypeatei »

michens wrote: post #273
inhumantsar wrote: post #111

Earlier quoted context omitted.

Technically fine yes but from a habits and practice standpoint it's safest to stick to a "not ever" rule and work around the limitations.

Care to explain? Keeping private keys inside the repo sounds fine for me as long as these keys are only used for local development, they are rotated regularly and are only valid for localhost (in case of TLS certs).

Not GP: If you make it normal to check in credentials and keys, then the risk of accidentally checking in prod secrets increases. It's basically making it comfortable for devs to deal with keys in repos and I think that's inherently dangerous.

Re: Tell HN: Whole Yandex Git repository leaked

#282

Post by recrof »

MonkeyMalarky wrote: post #90
ASalazarMX wrote: post #78

Earlier quoted context omitted.

Not only regulations, Chrome's builtin image search uses Google Lens to find products to sell you instead of simple reverse searches. It has become useless.

100% this. Google Lense is a product search engine, not image search.

nitpick: "lense" is not a word.

Re: Tell HN: Whole Yandex Git repository leaked

#283

Post by hanoian »

fidgewidge wrote: post #251
wizzwizz4 wrote: post #196

Earlier quoted context omitted.

> What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Not normally. https://en.wikipedia.org/wiki/Not_invented_here#In_computing More to the point: an organisation will usually use cleanroom techniques to clone something like this, if they choose to do so. Anyone who's been in contact with the ori…

You aren't allowed to use cleanroom techniques to clone something that's been stolen. You're still guilty of copyright violation for even downloading the code in the first place, and who knows, maybe also laws against receipt of stolen goods. Cleanroom reverse engineering is usually applied to a product that you've actually bought and paid for. You'd have to be really crazy to try and use this code for anything.

Yeah, reverse engineer the end product. You can't have one guy in the office looking at leaked code writing up detailed specs of how the code works and then giving that to someone to write.

Re: Tell HN: Whole Yandex Git repository leaked

#284

Post by aaaaaA4 »

guilhas wrote: post #225
digianarchist wrote: post #4

https://breached.vc/Thread-yandex-git-sources

How is this site allowed to be live? Yandex source is cool. But there are a lot of leaks with people private data The US authorities move mountains for TornadoCash, Z-Library, etc... why leave this one?

>The US authorities move mountains for TornadoCash, Z-Library, etc... why leave this one?

Nobody is moving mountains for those, what makes you think that?

Re: Tell HN: Whole Yandex Git repository leaked

#285

Post by GoblinSlayer »

ASalazarMX wrote: post #83
capableweb wrote: post #21

Earlier quoted context omitted.

No? It's 44GB of data. Magnet: magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.co…

It's a joy seeing flags from all the world in the torrent peers. Special mention to Ukraine and Russia itself.

It's VPN.

Re: Tell HN: Whole Yandex Git repository leaked

#286

Post by GoblinSlayer »

viraptor wrote: post #263
GoblinSlayer wrote: post #261

Earlier quoted context omitted.

Programming languages aren't really based on English. I'd say they are farther from English than English is from Proto-Indo-European.

They use English keywords, English documentation, English reference to the standard library, until recently were mostly restricted to English alphabet, and their development is mostly discussed in English.

Right, English uses some Proto-Indo-European words too. And Go designer compained that byte[] isn't English enough, so they did []byte, which is apparently perfectly English.

Re: Tell HN: Whole Yandex Git repository leaked

#287

Post by Havoc »

ranting-moth wrote: post #186
DonHopkins wrote: post #103

Has anyone found the FSB back-door portal?

Do they need a back door? Won't they just pick up the phone and ask for whatever they want. It isn't like anyone in Ruzzia is going to say 'no' when the FSB calls.

Everyone can say no. Once.

Re: Tell HN: Whole Yandex Git repository leaked

#288

Post by ormax3 »

eatbitseveryday wrote: post #132
capableweb wrote: post #21

Earlier quoted context omitted.

No? It's 44GB of data. Magnet: magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.co…

> Download at your own risk Baseless fear-mongering or is there some truth to this you can elaborate on?

just means that given the nature of BitTorrent, you will be exposing your IP address to other peers and trackers

Re: Tell HN: Whole Yandex Git repository leaked

#289

Post by aizen89 »

throwaway0766 wrote: post #272
tpmx wrote: post #3

I was super impressed when I interacted with Yandex ML engineering people like a decade ago on a conf call - they were trying to sell us their services. Very smart and very clearly outward-looking. Haven't followed the company in detail since. Wonder what happened to them. [removed inaccurate details]

Yandex was probably one of the best and the most innovative Russian companies, and attracted the best workforce. But it cooperated with Putin's regime long before the war. It censored opposition narratives in its search results and promoted pro-Putin content [1]. It continues to promote Russian propaganda even today (try any Ukraine-related search query in Russian). Now it's under the oversight of a Putin's man, Alek…

How do you think a company that has all its business in Russia should act?

Re: Tell HN: Whole Yandex Git repository leaked

#290

Post by jeroenhd »

not1ofU wrote: post #275
The_Colonel wrote: post #258

Earlier quoted context omitted.

Eh, it shares data with Russian government. If I have to choose between the two, I'll go with the US one.

why?

Russia is currently trying to invade and conquer even larger parts of Ukraine and a significant part of the world is helping Ukraine defend itself at the moment.

I prefer handing my data to privacy-breaching companies if the alternative would be handing data over to a state my government is currently holding a proxy war against.

Post reply on HN