111–120 of 499 posts
This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
[0] https://www.spiegel.de/international/business/we-know-where-...
Earlier quoted context omitted.
It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.
But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha
Earlier quoted context omitted.
> A bunch of ML researchers who were initially hired to do quant work Very interesting! I'm sure you have a source for this claim? This myth of DS being a side project literally started from one tweet. DeepSeek the company is funded by a company whose main business is being a hedge fund, but DeepSeek itself from day 1 has been all about building LLM to reach AGI, completely independent. This is like saying SpaceX is…
A valid response to my initial comment which was a bit tongue in cheek. However, i'm not sure that them being LLM researchers compared to quant researchers changes the dynamic of their relaxed security posture.
It does not indeed, but that's not the part I was commenting on.
This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
how many people in the world are used to deploying external client facing applications?
This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
That said, many developers might still prefer Turkish for naming DB tables, fields, variables, types and so forth if that’s the preference of the team. It wouldn’t be an exceptional situation. It’s quite easy too since Turkish also uses a Latin alphabet. May not be as easy or preferable in Chinese.
Earlier quoted context omitted.
It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.
But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha
Come to think of it, I wonder if there are language concepts that don't map to English that artificially restrict what we can program?
For example would programming U->D, R->L in Chinese (vs L->R, U->D in English) result in easier to read programs somehow?
Would being able to program using iconography (like a bunch of FE languages) result in more "screens" of text to aid understanding?
Earlier quoted context omitted.
It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.
But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha
Interesting to note: - Dev infra, observability database (open telemetry spans) - Logs of course contain chat data, because that's what happens with logging inevitably The startling rocket building prompt screenshot that was shared is meant to be shocking of course, but most probably was training data to prevent deepseek from completing such prompts, evidenced by the `"finish_reason":"stop"` included in the span attr…
As I understand, the finish reason being “stop” in API responses usually means the AI ended the output normally. In any case, I don't see how training data could end up in production logs, nor why they'd want to prevent such data (a prompt you'd expect to see a normal user to write) from being responded to.
> [...] I'm guessing Wiz wanted to ride the current media wave with this post instead of seeing how far they could take it.
Security researchers are often asked to not pursue findings further than confirming their existence. It can be unhelpful or mess things up accidentally. Since these researchers probably weren't invited to deeply test their systems, I think it's the polite way to go about it.
This mistake was totally amateur hour by DeepSeek, though. I'm not too into security stuff but if I were looking for something, the first thing I'd think to do is nmap the servers and see what's up with any interesting open ports. Wouldn't be surprised at all if others had found this too.
Earlier quoted context omitted.
You think they deliberately left their DB open to the internet, without a password? Why?
No, I did not claim that it was purposeful. But they did leave their DB open to the internet without a password. And that seems really negligent.
Earlier quoted context omitted.
It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.
But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha