So much effort in trying to tarnish DeepSeek the last 24hrs
[deleted]
Exposed DeepSeek database leaking sensitive information, including chat history
221–230 of 499 posts
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#222This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
There are many examples of experienced teams doing stupid things like exposing databases that I don't really think this is a valid conclusion to draw.
Right, just about 4 months ago Meta was fined for storing passwords in plain text:
https://news.ycombinator.com/item?id=41678840
The joke is these companies build systems that can tell them how to implement better security, they simply don't care.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#223Earlier quoted context omitted.
Your posturing is unwarranted. Literally in the first paragraph: > The Wiz Research team immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure
Posturing huh? Nice. That was intended to be helpful. Go read the CFAA. What they did is, believe it or not, illegal. I didn't make the law, and many think the CFAA is ridiculous, but that's how it works. If you even access a computer system beyond what you've been granted it's a CFAA violation with stiff penalties.
Quite the posturing with that last sentence
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#224Earlier quoted context omitted.
Not literally required, because languages typically support UTF-8 source files, but it would be difficult to use most popular software libraries without being able to at least read English.
Actually, most "most popular software libraries" have either translated docs, or guides in a non-English language. Furthermore, modern browsers can translate text on the fly. Some (like Yandex.Browser [1] not_an_ad) can even translate videos on the fly. [1] https://yandex.ru/project/browser/streams/technology (RU only)
Sure, most of them have docs in some non-English languages, but rarely all of them. And things like StackOverflow answers, bug reports and discussions, tutorials, and blog posts tend to be mostly in English. Autotranslate works to some extent but can be misleading or confusing when dealing with specialized terms that aren't well represented in its corpus. My Japanese coworkers certainly need to be able to comprehend written English.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#225The amount of vitriol in these comments is the really surprising data. I've seen the same on Twitter. I can only put it down to the financial pain DeepSeek inflicted on many US retail investors by wiping almost $700 billion off NVidia's stock price. I think a lot of folks didn't see it coming and it hurt them right where it matters most: In the wallet. The anger out there is very real.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#226This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
"Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools?"
Yes, that's what we did and do.
Depending on the project, I do use german variable names and comments at times, but stopped using all special characters like öüäß, they mess things up, despite in theory should just work fine.
Nowdays even chrome dev tools come in german, but experience shows, translated programming tools (or any software really) usually just have the UI a bit translated. But any errors you encounter or any advanced stuff will be in english anyway. And if you google issues of your translated UI, you won't find much, so better just use the original version.
So english it is.
(And it is the lingua franca in most parts of the world anyway)
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#227Earlier quoted context omitted.
Their models are open weights, and they are supported in ollama. You can run locally if you have sufficient hardware.
Well, thanks for not calling it open source! I did run it locally. It behaved as you would expect when asked about things the CCP cares about. https://hongkongfp.com/wp-content/uploads/2021/11/brave_udRs...
Well, it is technically open source, open weights, and closed training set, right?
(My recollection is that the training code is MIT licensed.)
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#228Earlier quoted context omitted.
Posturing huh? Nice. That was intended to be helpful. Go read the CFAA. What they did is, believe it or not, illegal. I didn't make the law, and many think the CFAA is ridiculous, but that's how it works. If you even access a computer system beyond what you've been granted it's a CFAA violation with stiff penalties.
Quite the posturing with that last sentence
omg dude it literally says that in the code: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#229So much effort in trying to tarnish DeepSeek the last 24hrs
Elsewhere perhaps, this seems like a pretty standard/legit security flaw in a new application which is found and hopefully quickly closed.
If your information is sensitive, do not use an LLM by public API - absolutely all of your data is being stored and processed. For all of them.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#230Another example of DeekSeek copying straight from OpenAI's playbook [1] [2]
[1] https://www.reuters.com/technology/cybersecurity/openais-int...