Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

141–150 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#141
post #121

[flagged]

Their models are open weights, and they are supported in ollama. You can run locally if you have sufficient hardware.

Well, thanks for not calling it open source! I did run it locally. It behaved as you would expect when asked about things the CCP cares about.

https://hongkongfp.com/wp-content/uploads/2021/11/brave_udRs...

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#142
post #11

Earlier quoted context omitted.

Plus Volkswagen and Subaru in the last few weeks ...

Plus Volkswagen and Subaru in the last few weeks Both Volkswagen and Subaru have leaked his DNA in the last few weeks? Dude gets around.

On top of SSN and DNA, also the location of the DNA has been leaked.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#144
post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

It might seem less credible to encounter English in a place where it’s less expected, but think of it this way: would a Yandex-developed ClickHouse database be adopted by Chinese devs if everything in it were written in Russian? There is some merit in asking your question, for there’s an unspoken rule (and a source of endless frustration) that business-/domain-related terms should remain in the language of their orig…

In the wild I've seen a company returning a JSON key "ankunftTime" in one of their APIs

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#145
post #137

Earlier quoted context omitted.

Wow all the gamers with mad LLM skillz.

Pretty sure gamers are mentioned because those are the usual demo that has GPUs with enough memory outside of people in the ML industry.

So you’re in the demo scene as well? Yay

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#147

This is totally expected when you use AI to build your infrastructure.

I was going to say the opposite, ironic because an LLM would have told them not to do that if they were working closely with one.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#148
post #58

Interesting to note: - Dev infra, observability database (open telemetry spans) - Logs of course contain chat data, because that's what happens with logging inevitably The startling rocket building prompt screenshot that was shared is meant to be shocking of course, but most probably was training data to prevent deepseek from completing such prompts, evidenced by the `"finish_reason":"stop"` included in the span attr…

> but most probably was training data to prevent deepseek from completing such prompts, evidenced by the `"finish_reason":"stop"` included in the span attributes As I understand, the finish reason being “stop” in API responses usually means the AI ended the output normally. In any case, I don't see how training data could end up in production logs, nor why they'd want to prevent such data (a prompt you'd expect to se…

Seems that you're right! Also, not that I doubted they were using OpenAI, but searching for `"finish_reason"` on the web all point to openai docs. Personally, I wouldn't say it's a very common attribute to see in logs generally.

https://platform.openai.com/docs/api-reference/introduction

Right there in the docs:

> Now that you've generated your first chat completion, let's break down the response object. We can see the finish_reason is stop which means the API returned the full chat completion generated by the model without running into any limits.

Regarding how training data ends up in logs, it's not that far fetched to create a trace span to see how long prompts + replies take, and as such it makes sense to record attributes like the finish_reason for observability purposes. However the message being incuded itself is just amateur, but common nonetheless.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#150
post #92

Earlier quoted context omitted.

Hundreds of thousands. My employer alone probably has 1000.

No. I don’t think so. I think if you took many engineers and sat them at a computer and asked them to stand up a whole dev staging prod system they wouldn’t be able to do it. I certainly would not, or it would take me a significant amount of time to do properly. I have been a full stack dev for 10 years. Now take that one step further to someone whose only interaction with a development is numpy, pandas, julia, etc……

> I think if you took many engineers and sat them at a computer and asked them to ...

There are many in the software engineering field which could not satisfy a request of this nature, for any reasonable form of "asked them to".

Post reply on HN