Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale didn't stop the Hugging Face intrusion

tailscale.com

Post reply on HN
Print view View original

181–190 of 239 posts

Re: Tailscale didn't stop the Hugging Face intrusion

#181

Post by lukeschlather »

ahofmann wrote: post #46

Wow, this article is super smart marketing by tailscale. Not only do they list all the nice and expensive features, that can help in such a situation but they also show that someone at huggingface made a very stupid thing by writing a reusable auth key in an env file. Everyone using mesh VPNs like tailscale, netbird etc. knows that this is like leaving the keys right at the door.

> they also show that someone at huggingface made a very stupid thing by writing a reusable auth key in an env file

I don't see where it says that. The Tailscale key specifically it says was stored in the kubernetes secret manager, and obtained once the attacker already had root on the k8s cluster, so would've had full access to all the secrets stored in a sensible fashion.

They did get root by dumping the environment for a process, but "don't store secrets in environment variables" while it is a valid bit of hardening advice, I wouldn't call it stupid to store a secret in an environment variable.

Re: Tailscale didn't stop the Hugging Face intrusion

#182

Post by calebkaiser »

colechristensen wrote: post #91
andy99 wrote: post #60

Earlier quoted context omitted.

Why not? If done right it’s a good way to talk about implications for those companies and provide some education like tailscale did here. We also saw Anthropic post about “our agent escaped too” and while I understand the incident caused them to review, they found something and needed to disclose, the whole thing came across much worse and largely they got mocked or accused of trying to piggyback, so obviously there…

This all has the -aire of theatre. OH NOES THE POWERFUL AI GOT OUT Then everyone coming out with humbled determination about working together to responsibly use and contain this powerful technology for the greater good (and profit margin). I will not believe marketing gimmickry is not a large part of what's going on with every one of these "incidents".

I'm typically very skeptical of most content marketing/corporate PR.

In the case of this incident, I struggle to see the clear upshot for OpenAI. It seems pretty unlikely they'd ever okay this intentionally as some sort of marketing.

For one, it'd be pretty damning when it leaked that this was a setup, and it would 100% leak at some point. But more importantly, it really flies in the face of the general argument frontier labs have been putting forth around the dangers of "ungovernable" open models and the role of frontier labs as responsible custodians. Members of OpenAI's leadership team were actually in the middle of a Twitter spat with HuggingFace employees/open model advocates about open models being generally decel and bad when this happened.

HF immediately got to show that they were only able to respond to the incident because of open models, that we can't rely on labs to be our sole source of stewardship, etc as a result of this.

Re: Tailscale didn't stop the Hugging Face intrusion

#183

Post by calebkaiser »

docapotamus wrote: post #157
Analemma_ wrote: post #149

Earlier quoted context omitted.

> These are false flag operations. The level of "I need to be the smartest person in the room" bullheaded skepticism on Hacker News has always been bad, but now with these latest LLM developments it is just completely out of control. A company is reporting an intrusion and how they plan to address the vulnerabilities it exposed in the future, and you're here going "seems shopped, I can tell from the pixels".

I don't think that's what is being said. False flag, I presume in this scenario is to say were going to do something about the impending "AI threat" and to be associated with it. There is probably little threat, but to some investors this starts to look like perceived "AGI". Getting your name involved in the hype is marketing 101

I think the commenter is saying that OpenAI committed a false flag operation, not Tailscale.

For Tailscale, this may very well be marketing, but it would be strangely self defeating for OpenAI to do something like what is being suggested. Showing that you failed to govern your model is a pretty poor way to say "We're the only ones who should be trusted to govern frontier models".

Re: Tailscale didn't stop the Hugging Face intrusion

#185

Post by supriyo-biswas »

calebkaiser wrote: post #182
colechristensen wrote: post #91

Earlier quoted context omitted.

This all has the -aire of theatre. OH NOES THE POWERFUL AI GOT OUT Then everyone coming out with humbled determination about working together to responsibly use and contain this powerful technology for the greater good (and profit margin). I will not believe marketing gimmickry is not a large part of what's going on with every one of these "incidents".

I'm typically very skeptical of most content marketing/corporate PR. In the case of this incident, I struggle to see the clear upshot for OpenAI. It seems pretty unlikely they'd ever okay this intentionally as some sort of marketing. For one, it'd be pretty damning when it leaked that this was a setup, and it would 100% leak at some point. But more importantly, it really flies in the face of the general argument fron…

> It seems pretty unlikely they'd ever okay this intentionally as some sort of marketing. > Members of OpenAI's leadership team were actually in the middle of a Twitter spat with HuggingFace employees/open model advocates

The point of these campaigns is to eventually invoke some sort of response from the government, such as banning open models, which OpenAI (and Anthropic) stand to benefit from.

Re: Tailscale didn't stop the Hugging Face intrusion

#186

Post by kortilla »

This feels like a way tailscale’s model fails. On the surface it seems fine but if you push on it you realize auth keys to register new devices are way over powered but yet there is no alternative for people who want to automate enrollment.

Something is missing to allow automation without auto approval

Re: Tailscale didn't stop the Hugging Face intrusion

#187

Post by liesliy »

andy99 wrote: post #60
guessmyname wrote: post #51

Expect similar articles (cough, ads, cough) in the next couple of days from every single company whose software was involved in the incident.

Why not? If done right it’s a good way to talk about implications for those companies and provide some education like tailscale did here. We also saw Anthropic post about “our agent escaped too” and while I understand the incident caused them to review, they found something and needed to disclose, the whole thing came across much worse and largely they got mocked or accused of trying to piggyback, so obviously there…

[flagged]

Re: Tailscale didn't stop the Hugging Face intrusion

#188

Post by senordevnyc »

DC-3 wrote: post #41
smb06 wrote: post #20

Earlier quoted context omitted.

Glad to see companies owning responsibility and putting out a message without corporate PR spin

If you can't see the spin on corporate messaging it means it's working (and consequently, to stretch the metaphor, your wicket is in danger).

This seems unfalsifiable :)

Re: Tailscale didn't stop the Hugging Face intrusion

#189

Post by ivlad »

The whole post is a PR activity presented as some kind of analysis. It is bs.

First, long-living credentials are the standard because the machinery to rotate them is complicated and, in fact, via indirection requires another set of long-living credentials. Out of all problems that any security engineering team has to solve at an organisation, this one stands high on the cost of implementation, adds friction to everyone involved including end-users, and is low on the value provided (compare to, say, network segmentation).

Second, while proclaiming no long-living credentials, they, in fact argue for concentration of long living credentials in running software that will be the target of intrusion. They say, the options are “a vault that only issues short-lived creds based on long-lived creds that you insert once and that it never gives back” and “a credential-injecting proxy”. Both of those applications hold long-living credentials in memory. Recall, the attacker had root privileges on the node, so dumping the creds from the memory with a little disassembly if needed, was in reach of the AI agent.

Funny enough, they dismiss the working solution: “we had to turn TPM storage off by default on Linux and Windows” - because they could not figure out how to work with TPM? Resealing and the workings of configuration registers is non-trivial, I admit, but totally manageable.

To sum up, I feel the author bends backwards to preach for the religion of short-living credentials even when they are not a solution while providing contradictory arguments for their case. This is why I called it bs.

Re: Tailscale didn't stop the Hugging Face intrusion

#190

Post by causal »

alxfrnr wrote: post #133

I love you Tailscale but please we don't need a 2k words ai written essay when the actual substance can fit in 3 sentences. That's not good for anyone.

I'm usually pretty sensitive to AI written content but nothing in this article made me think it was
Post reply on HN