Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale didn't stop the Hugging Face intrusion

tailscale.com

Post reply on HN
Print view View original

141–150 of 239 posts

Re: Tailscale didn't stop the Hugging Face intrusion

#141

Post by brendoelfrendo »

inigyou wrote: post #106
brendoelfrendo wrote: post #52

Earlier quoted context omitted.

I mean, they do happily explain the TailScale features that you can use to avoid this kind of issue, but the general advice of "don't leave long-lived keys lying around where they're accessible, do anything except for that" is pretty generic, good advice.

You always need a long-lived key somewhere. Keeping it in an HSM is probably the safest, but also pretty expensive.

Yes, you'll probably need to buy a specific tool or product to have secure key storage. If you're running infrastructure that requires long-lived secrets, then you either need to have a place to keep them and a plan for secrets lifecycle management, or you need to accept the risk that those secrets could be compromised.

Re: Tailscale didn't stop the Hugging Face intrusion

#144

Post by walrus01 »

qlte wrote: post #140
walrus01 wrote: post #117

Earlier quoted context omitted.

Sure seems like it. Real humans don't write exclusively one sentence comments. It doesn't look like the post history of anyone here that I'm fairly sure is a real meat based mammal. It looks like someone gave an LLM an instruction to write exclusively short and snappy comments that are somewhat relevant to the original post.

> … comments that are somewhat relevant to the original post. This is a really common tell for HN bot accounts I find, even when effectively disguised/customized to drop the most obvious LLM cliches/em-dashes/etc. In a vacuum a specific comment may be more or less fine, or just a tad over baked like the parent post giving it an uncanny valley feel though otherwise passable. But even people who diligently try to stay…

It would probably not be overly difficult to prompt a read-only LLM to view an account's comment history in aggregate (like, say, the last 100 comments) and compare them what is the topic of the original post that they're commenting on. You would probably need it to view/retrieve the contents of the page that is linked in the original post to determine the general context.

For the purpose of coming up with some kind of score of whether the commenter is sticking rigidly to the topic of the original post, or is going on any kind of tangent.

As a possible tool for moderation, consider it Bot on bot warfare.

Re: Tailscale didn't stop the Hugging Face intrusion

#145

Post by pkulak »

Another driving home of the point that LLMs can be so damn FAST. I finally got around to moving a homeserver project from one machine to another last weekend. 4 docker containers and a couple postgres DBs. A year ago, I would have been happy with a couple hours of downtime while I dumped databases, rsynced data directories, hand-wrote new compose files, etc. This time, I pointed an agent at both servers and the downtime was less than a minute. Even watching it like a hawk, it was tough to keep up with everything it was doing.

All my life, "catching it in time" has been a relevant security strategy. :/

Re: Tailscale didn't stop the Hugging Face intrusion

#146

Post by glitcher »

alxfrnr wrote: post #133

I love you Tailscale but please we don't need a 2k words ai written essay when the actual substance can fit in 3 sentences. That's not good for anyone.

I felt like the 2 sentence intro at the top was a sufficient tl;dr for me at least, didn't pay attention to the quality/length of the rest.

Re: Tailscale didn't stop the Hugging Face intrusion

#147

Post by SOLAR_FIELDS »

ahmedehab_01 wrote: post #116

This actually shows that it was a human error on HuggingFace's end that led to that "breach". I would say HuggingFace needs to prioritize both security metrics/alerts and metrics/alerts for node count. And not leave long-lived keys accessible easily like this. It would have been way more groundbreaking if the agent found an actual vulnerability in Tailscale.

I think the situation is slightly more nuanced than that. When the easiest path by far is long lived keys, there is something to be said about the security posture of a solution where those are the default behavior, especially if they don’t actively discourage usage in documentation. For instance if you go to aws and try to create an iam user with access key/secret key they warn the shit out of you multiple times. They say things like “this is a bad idea” “we don’t recommend this” and “use this better solution instead”. I think if you’re providing an auth service like this you have some level of responsibility to guide people towards the less naive solution - part of what you’re selling in an auth offering is security, so if you default to garbage security, you don’t have a very good offering

Re: Tailscale didn't stop the Hugging Face intrusion

#148

Post by eyujjbujgghhjj »

ripbozo wrote: post #137
claiir wrote: post #108

Earlier quoted context omitted.

Bot account. This sounded like LLM text. I went through all your other comments, and of your thousands of comments written in 35 days, every other one is also similarly written by LLM. Some superficial comment usually commenting on the title, always lowercase, always load-bearing and honest.

it was created 35 days ago and already has 418 karma. I've been here for over 6 years and don't even have half of that

[flagged]

Re: Tailscale didn't stop the Hugging Face intrusion

#149

Post by Analemma_ »

sscaryterry wrote: post #122
bilekas wrote: post #78

Earlier quoted context omitted.

And I have no problem with this. Infact it would be nice to be a point of pride to be there to say how your security is handled.

I think this is simply a case of Tailscale saying, we've got no idea what these guys (OpenAI) are talking about. All these incidents are scarce on technical details . Honestly, IMHO, OpenAI and Anthropic are now actively pushing for AI regulation, as a defence mechanism. These are false flag operations.

> These are false flag operations.

The level of "I need to be the smartest person in the room" bullheaded skepticism on Hacker News has always been bad, but now with these latest LLM developments it is just completely out of control. A company is reporting an intrusion and how they plan to address the vulnerabilities it exposed in the future, and you're here going "seems shopped, I can tell from the pixels".

Re: Tailscale didn't stop the Hugging Face intrusion

#150

Post by ivanjermakov »

bumbledraven wrote: post #18

Does Tailscale offer a "security checkup" function? Best practices evolve over time, and it would be nice to know if I'm using the recommended configuration.

Not exactly what you're asking, but they have a way to test their ACL policies: https://tailscale.com/docs/reference/syntax/policy-file#test...
Post reply on HN