Does DeepSeek have a bug bounty program I'm not aware of with a clearly defined scope? It appears that Wiz took it upon themselves to probe and access DeepSeek's systems without permission and then write about it. If you do this and the company you're conducting your "research" on hasn't given you permission in some form, you can get yourself in a lot of hot water under the CFAA in the USA and other laws around the w…
Yes but they’re chinese so it’s okay /s
They are getting DoS’d by us gov too so they were only trying to help /s
> I think if you took many engineers and sat them at a computer and asked them to ... There are many in the software engineering field which could not satisfy a request of this nature, for any reasonable form of "asked them to".
I don’t understand this comment? Is it unusual to request something like this? OP’s comment was saying that all 1000 or so (and hundreds of thousands of others) of his colleagues would be able to do this if asked? I don’t know if you are in agreement with me or not
I am agreeing with your premise of asking a random s/w technician to deploy an app fairly securely would be problematic and then generalized it to include many tasks related to s/w engineering.
This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
I worked at a Chinese company for a while and they used Chinese in meetings but English in the code base.
Does DeepSeek have a bug bounty program I'm not aware of with a clearly defined scope? It appears that Wiz took it upon themselves to probe and access DeepSeek's systems without permission and then write about it. If you do this and the company you're conducting your "research" on hasn't given you permission in some form, you can get yourself in a lot of hot water under the CFAA in the USA and other laws around the w…
Does DeepSeek have a bug bounty program I'm not aware of with a clearly defined scope? It appears that Wiz took it upon themselves to probe and access DeepSeek's systems without permission and then write about it. If you do this and the company you're conducting your "research" on hasn't given you permission in some form, you can get yourself in a lot of hot water under the CFAA in the USA and other laws around the w…
lol
written like someone who has never litigated even a traffic light
It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.
But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha
A for loop and other syntax keywords are barely the only English people have to understand in programming. One could say that these could just as well be arbitrary symbols, and programmers would just memorize them. But think of all the concepts named in English such as exception, factory, facade, adapter, interface, iterator, needle, haystack, constructor, queue... you name it. Not to mention documentation. So yeah, some English is mandatory, even if we're not able to communicate properly. In some projects though it's not uncommon to use local language for the domain while still keeping technical concepts in English, like getAnniversaire() or PersonneTable.
Does DeepSeek have a bug bounty program I'm not aware of with a clearly defined scope? It appears that Wiz took it upon themselves to probe and access DeepSeek's systems without permission and then write about it. If you do this and the company you're conducting your "research" on hasn't given you permission in some form, you can get yourself in a lot of hot water under the CFAA in the USA and other laws around the w…
They're publicly accessible URLs.
DeepSeek & users that had data exposed here should be thanking Wiz.
Why is ClickHouse exposing unauthenticated database access at port 9000 to the public? Is this the default behavior or did DeepSeek open it up for dev purposes?
ClickHouse does not allow external connections by default. If someone wants to configure an unauthenticated access from the Internet, they have to do the following extra steps: - enable listening to the wildcard address; - remove IP filtering for the default user; - set up a no-password authentication; It is possible to ignore and turn off all guardrails that the system has by default, but it needs extra efforts. How…
Thanks for your insight. I got ratioed to fuck for trying to defend the standpoint that this is an unusual expectation of a regular engineer to stand this up correctly.
And that's why you run models locally. Or if you want a remote chat model, use something stateless like AWS Bedrock custom model import to avoid having stored chats on the server.