Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

Post reply on HN
Print view View original

171–180 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#171

Post by pinoy420 »

MobiusHorizons wrote: post #160
pinoy420 wrote: post #110

Earlier quoted context omitted.

No. I don’t think so. I think if you took many engineers and sat them at a computer and asked them to stand up a whole dev staging prod system they wouldn’t be able to do it. I certainly would not, or it would take me a significant amount of time to do properly. I have been a full stack dev for 10 years. Now take that one step further to someone whose only interaction with a development is numpy, pandas, julia, etc……

I would consider it table stakes for an intermediate level engineer at a big company (which would have well defined processes for doing this safely) or a senior at any other company (on the assumption some of that infra has to be set up from scratch). If 10 years of experience hadn’t taught me this yet, I would personally be concerned how I’m spending my energy. I am roughly at the 10y mark, and I would estimate I ha…

HN is a bubble. The expectation that your colleagues are /experts like you/ is unrealistic. To stand something up like this, which is entirely on bare metal - this is a task many would find challenging if they are entirely honest with themselves and put their egos to the side. Your typical swe thinks that nothing is impossible.

There was a recent comment which said along the lines of “I used to watch figure skating, seeing them race around and spin, and think no big deal. It was only when I went on ice that I realised how difficult and impressive what they were doing was” - this is exactly the trap SWEs are most guilty of. — /this/ is what you learn as a staff level.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#172

Post by throwaway314155 »

AlexClickHouse wrote: post #151
nyclounge wrote: post #21

Earlier quoted context omitted.

Why is ClickHouse exposing unauthenticated database access at port 9000 to the public? Is this the default behavior or did DeepSeek open it up for dev purposes?

ClickHouse does not allow external connections by default. If someone wants to configure an unauthenticated access from the Internet, they have to do the following extra steps: - enable listening to the wildcard address; - remove IP filtering for the default user; - set up a no-password authentication; It is possible to ignore and turn off all guardrails that the system has by default, but it needs extra efforts. How…

lol, nice. getting out in front of anyone even potentially pointing fingers at ClickHouse. Good initiative.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#174

Post by benatkin »

asdasdsddd wrote: post #140
sailingparrot wrote: post #79

Earlier quoted context omitted.

> A bunch of ML researchers who were initially hired to do quant work Very interesting! I'm sure you have a source for this claim? This myth of DS being a side project literally started from one tweet. DeepSeek the company is funded by a company whose main business is being a hedge fund, but DeepSeek itself from day 1 has been all about building LLM to reach AGI, completely independent. This is like saying SpaceX is…

Just to be pedantic, spaceX predates tesla

The carmaking bro predates SpaceX. He had a BMW in college and got a supercar in 1997. While he wasn’t a carmaker yet he got started with cars earlier.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#175

Post by llm_nerd »

lysace wrote: post #165
llm_nerd wrote: post #152

Earlier quoted context omitted.

As a Canadian, I don't particularly care what the Chinese government knows about me. They represent zero threat to me, and honestly I'm rational enough to know that they don't particularly care what I'm up to. US companies, on the other hand...did you miss where all of the tech oligarchs lined up in an obsequious little row to proselytize before the newly anointed king? When they all went on a spree in advance to sho…

1. I'm not American. 2. The choice is not between US and China. 3. Communism is just destructive . Trust me, you'll eventually figure this one out.

I didn't assume you were American. But there is 100% chance that you share an enormous amount of information with American firms, given that they have exponential more of a global reach. And if you're in Europe, the US literally represents more of a threat to you than China does.

As to communism, thanks for the patronizing noise however the choice isn't between communism or a profoundly corrupt, lawless "democracy" where a nuclear armed, mega-military egotistical megalomaniac thinks "might makes right" and casually talks about manifest destiny.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#176

Post by dragonwriter »

sghiassy wrote: post #94
creakingstairs wrote: post #90

Earlier quoted context omitted.

It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.

But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha

> But like, you can’t program Java without English right?

Sure you can, if you know Java, which is its own language distinct from any natural language.

Conversely, you can't program in Java if you know English, but not Java.

> A for-loop has to be written in English??

No, it has to be written in Java. It's true that Java keywords are mostly themselves borrowed from English (often by way of C++ or other computer languages rather than directly) with a use in Java that has some connection to the meaning in English, so its probably easier to learn Java if you already know English (even before considering that there is probably more and better documentation in English than other languages), but that's not the same as English being a requirement for programming Java.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#177

Post by [deleted] »

llm_nerd wrote: post #175
lysace wrote: post #165

Earlier quoted context omitted.

1. I'm not American. 2. The choice is not between US and China. 3. Communism is just destructive . Trust me, you'll eventually figure this one out.

I didn't assume you were American. But there is 100% chance that you share an enormous amount of information with American firms, given that they have exponential more of a global reach. And if you're in Europe, the US literally represents more of a threat to you than China does. As to communism, thanks for the patronizing noise however the choice isn't between communism or a profoundly corrupt, lawless "democracy" w…

[deleted]

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#178

Post by saturn8601 »

henry2023 wrote: post #167
throw_pm23 wrote: post #159

Earlier quoted context omitted.

Software is unfortunately a side-project for most auto makers :)

With the amount of complexity found in modern car's pre-packaged software I'd not be so sure.

No he is right, hardware manufacturers treat software as a line item and just part of the BOM. Typically just contracted out (although some are trying to change that) Thats why its typically mediocre from companies outside of SV.

You need a software first agile mentality from the leadership of the company on downwards and these legacy companies just dont have it.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#179

Post by kdmtctl »

0x457 wrote: post #109
jvansc wrote: post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

Unless they're using a programming language that isn't English-based (for example, Russian 1С system uses Russian keywords and the whole codebase is usually in Russian), then most of the code stays English. This way, you don't have to change keyboard layout while writing code. Anyway, you're forced to learn some English when doing any real software development.

Anecdotally, a lot of 1C developers are not proficient in anything else because they don't need English in the main field, platform docs included, and can only get scarce translated versions of anything else. And blogs in Russian, which are not plenty and not always correct.

This makes some of their infra work and common misconceptions a little bit ... esoteric. So, English is crucial not just to do the job but to get best practices and CS info in general. It really helps a lot.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#180

Post by throwaway314155 »

hi_hi wrote: post #164

I don't get the discussions around side project and they're ML engineers, not security experts. Why are you excusing a company for a serious security leak. If you're releasing a major project into the wild, expect serious attention and have the money, you get third parties involved to test for these things before you launch. Now can we get back to discussing the real conspiracy theories. This is clearly a disinformat…

> I don't get the discussions around side project and they're ML engineers, not security experts. Why are you excusing a company for a serious security leak.

No one is here as far as I can tell. But if you've ever been a software engineer who is required to work with someone purely from an ML lab and/or academia, you'll quickly discover that "principled software engineering" just isn't really something they consider an important facet of software. This is partly due to culture in academia, general inexperience (in the software industry) and deeply complicated/mathematical code really only needing to be read by other researchers who already "get it", to a degree.

Not an excuse but rather an explanation for _why_ such an otherwise impressive team might make a mistake like that.

Post reply on HN