Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

Post reply on HN
Print view View original

211–220 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#211

Post by notatoad »

sghiassy wrote: post #82
rcruzeiro wrote: post #65

Earlier quoted context omitted.

Someone who worked on a non-English environment years ago here: sometimes you do use the local language in some contexts, but, more often than not, you end up using English for the majority of stuff since it's a bit off-putting to mix another language with the English of programming languages and APIs.

Dumb question, but it would then seem that you have to know English to program??

for all intents and purposes, yes.

relying on machine-translated documentation or limiting yourself to only using libraries written in your native language would be a huge impediment.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#212

Post by mmaunder »

soulofmischief wrote: post #206
mmaunder wrote: post #185

Does DeepSeek have a bug bounty program I'm not aware of with a clearly defined scope? It appears that Wiz took it upon themselves to probe and access DeepSeek's systems without permission and then write about it. If you do this and the company you're conducting your "research" on hasn't given you permission in some form, you can get yourself in a lot of hot water under the CFAA in the USA and other laws around the w…

Your posturing is unwarranted. Literally in the first paragraph: > The Wiz Research team immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure

Posturing huh? Nice. That was intended to be helpful. Go read the CFAA. What they did is, believe it or not, illegal. I didn't make the law, and many think the CFAA is ridiculous, but that's how it works. If you even access a computer system beyond what you've been granted it's a CFAA violation with stiff penalties.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#213

Post by hi_hi »

throwaway314155 wrote: post #180
hi_hi wrote: post #164

I don't get the discussions around side project and they're ML engineers, not security experts. Why are you excusing a company for a serious security leak. If you're releasing a major project into the wild, expect serious attention and have the money, you get third parties involved to test for these things before you launch. Now can we get back to discussing the real conspiracy theories. This is clearly a disinformat…

> I don't get the discussions around side project and they're ML engineers, not security experts. Why are you excusing a company for a serious security leak. No one is here as far as I can tell. But if you've ever been a software engineer who is required to work with someone purely from an ML lab and/or academia, you'll quickly discover that "principled software engineering" just isn't really something they consider…

Yeah, you're right, I was conflating the excusing bit.

I haven't worked with serious ML engineers, but having worked in large webdev there's usually a team involved in these projects, including senior none devs who would ensure the correct checks and balances are in place before go live. Does this not happen in ML projects? (of course there are always exceptions and unknowns that will slip through, I don't know if that was the case here, or something else)

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#214

Post by octacat »

diggan wrote: post #64
blackeyeblitzar wrote: post #42

Earlier quoted context omitted.

DeepSeek isn’t a side project or just a bunch of quants - these are part of the marketing that people keep repeating blindly for some reason. To build DeepSeek probably requires at least a $1B+ budget. Between their alleged 50,000 H100 GPUs, expensive (and talented) staff, and the sheer cost of iterating across numerous training runs - it all adds up to far, far more than their highly dubious claim of $5.5M. Anyone s…

> Anyone spending that amount of money isn’t just doing a side project. You're reciting a bunch of absolute numbers, without any sort of context at all. $5M isn't the same for every company. For example, in 2020, it seems High Flyer spent a casual $27M on a supercomputer. They later replaced that with a $138M new computer. $5.5M sounds like something that could be like a side-project for a company like that, whose bl…

5.5M is a single latest training run, if they would rent gpu-s in the cloud - from the paper.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#215

Post by lysace »

kdmtctl wrote: post #201
lysace wrote: post #121

[flagged]

Not being a fan of CCP, I wonder how many times you did ask ChagGPT about CCP? Why bother suddenly? Should it matter for a Chinese model which is genuinely good in every other aspect? Don't take it personally, please. Just measuring my internal self which I inherited by coexisting many years with a similar regime.

I'm kind of old for HN. I (sort of) know what happened.

I'm concerned about later generations and about this information getting deleted.

I also think there's a clear risk of a currently democratic country becoming communistic within the the next 20-40 years. Inevitably, mass murder follows.

So I want what happened preserved in the day-to-day-consciousness, not deleted/censored.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#216

Post by byearthithatius »

reaperducer wrote: post #23
sho_hn wrote: post #11

Earlier quoted context omitted.

Plus Volkswagen and Subaru in the last few weeks ...

Plus Volkswagen and Subaru in the last few weeks Both Volkswagen and Subaru have leaked his DNA in the last few weeks? Dude gets around.

heeheehee;) i REALLY like cars

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#217

Post by Twirrim »

yk wrote: post #111
hdlothia wrote: post #5

This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.

That's pretty much the same mistake as in VW recent "We know where you parked" hack. [0] So while I don't really want to say anything nice about VW, the mistake is no something that only happens to side projects. [0] https://www.spiegel.de/international/business/we-know-where-...

This is also something that keeps affecting "smart" software engineers with projects, that don't realise they've got misconfigured S3 buckets, or have Firebase or Mongodb etc. wide open to the world. We've seen so many companies that absolutely should know better be in this area.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#218

Post by wongarsu »

sghiassy wrote: post #94
creakingstairs wrote: post #90

Earlier quoted context omitted.

It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.

But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha

I learned Pascal before I learned many English words like "if". You don't need to know what "if" or "for" mean to remember those keywords or to know what they do.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#219

Post by Twirrim »

londons_explore wrote: post #128
david-gpu wrote: post #69

Earlier quoted context omitted.

> Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? That is precisely what happens. It is not unusual for code and databases to be written in English, even when the developers are from a non-English speaking country. Think about it: the toolchain, programming language and libraries are all based on English anyway.

Interestingly, in the world of electronics this used to be true too. The first Diode on a circuit board would be marked "D1", no matter which country produced it. Datasheets for components would be in english. Any text on a circuit board would be in english (ie. "Voltage Select Switch" or "Copyright 2025".). However, a few years back it became common for most datasheets to be available in mandarin and english, and th…

> Not everything changes though - gold plating thickness is measured by the micro-inch

Considering how much manufacturing and science etc. has fully migrated to metric, even in the US, this seems bizarre to me.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#220

Post by lukan »

princemaple wrote: post #187
sghiassy wrote: post #82

Earlier quoted context omitted.

Dumb question, but it would then seem that you have to know English to program??

Kinda. Some of them know all the English words in the programming language they code in, and not much else.

Subset of the english language, is the right term I believe.

(someone who had to learn english to do programming)

Post reply on HN