Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

Post reply on HN
Print view View original

261–270 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#261

Post by gleenn »

m00x wrote: post #245
mmaunder wrote: post #225

The amount of vitriol in these comments is the really surprising data. I've seen the same on Twitter. I can only put it down to the financial pain DeepSeek inflicted on many US retail investors by wiping almost $700 billion off NVidia's stock price. I think a lot of folks didn't see it coming and it hurt them right where it matters most: In the wallet. The anger out there is very real.

The hit on NVidia's stock price makes no sense to me. DeepSeek uses H100s and H800s. They'll likely have reasons to buy more now, and America will want to compete even harder, buying more chips. American companies are still way ahead as well, but they're just getting more competition. This will be healthy.

The stock price had assumptions baked in about the number of units expected to be sold. DeepSeek cut that hardware estimate by as much as 45x. That is that absolute obvious correlation between that model being very efficient to train and NVDA dropping 18%.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#262

Post by jstanley »

dogtierstatus wrote: post #238
saturn8601 wrote: post #178

Earlier quoted context omitted.

No he is right, hardware manufacturers treat software as a line item and just part of the BOM. Typically just contracted out (although some are trying to change that) Thats why its typically mediocre from companies outside of SV. You need a software first agile mentality from the leadership of the company on downwards and these legacy companies just dont have it.

> software first agile mentality I can release a website with a list of known bugs. Do any govt allow release of cars with known bugs?

There's a wide spectrum of possible bugs. I would hazard that every car ever sold was sold with known bugs.

As long as you're reasonably confident that the bugs don't pose a safety issue I don't see the problem.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#263

Post by lurking_swe »

jijji wrote: post #249
mmaunder wrote: post #225

The amount of vitriol in these comments is the really surprising data. I've seen the same on Twitter. I can only put it down to the financial pain DeepSeek inflicted on many US retail investors by wiping almost $700 billion off NVidia's stock price. I think a lot of folks didn't see it coming and it hurt them right where it matters most: In the wallet. The anger out there is very real.

Did you even read the article? It's about the backend of deepseek.com being completely unprotected to the point where all the prompts users typed in are being exposed to the public. The fact that these people are supposed to be competent leads most to believe this is a backend for the CCP to spy on users. Competent or not, I would not use that system for anything. If anything, one might host it locally and use it in…

it’s a FREE LLM chat interface, that doesn’t require you to enter your real name or credit card information. Who cares? It’s not a government website or a tax software application.

Obviously i am disappointed regarding this, but people really blow this out of proportion imo. Rumor is this was a side project for some employees at a hedge fund. you think they specialize in security and software application best practices? i’m not exactly surprised that it’s insecure.

The really crazy thing is that anyone gives ANY company sensitive data to train on. regardless of which country the service is running in. That’s what’s actually crazy.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#264

Post by sho_hn »

karim79 wrote: post #260
sho_hn wrote: post #255

Earlier quoted context omitted.

> How is this a "threat". Given how closely major US tech companies are now affiliated and partnered with the US Federal government, arguably the direct potential threat from them to US citizens may well be higher than from across a very big pond. People trot out "I'd rather our guys spy on me than them" a lot, but that's putting a lot of faith in your local government. Conversely, who do you think has more to fear f…

I think you missed my point, or I wasn't clear enough. Your point is exactly the one I was trying to make. I think I must re-examine my articulation.

I wasn't arguing against you, rather extending your argument for further effect. Should've prefixed with "Indeed, ...", sorry.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#265

Post by lukan »

jychang wrote: post #258
lukan wrote: post #239

Earlier quoted context omitted.

'DeepSeek is the side project of a bunch of quants' I doubt it very much that it only was that and not massivly backed by the Chinese state in general. As with OpenAI, much of this has to do with hype based speculation. In the case of OpenAI they played with the speculations, that they might have AGI locked up in their labs already and fueled those speculations. The result, massive investment (now in danger). And Chi…

I don't buy this, simply because if the Chinese government were to back an effort, it wouldn't be Deepseek. Alibaba has Qwen. Baidu, Huawei, Tencent, etc all have their own AI models. The Chinese government would most likely push one of these forward with their backing, not an unknown small company.

Unless of course, they want to sell the "small underdog" story.

I don't claim it is all staged. The researchers seem genuine. But they can be good researchers and still said yes at some point to big government help, if smart chinese government employes recognized their potential.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#266

Post by throwaway314155 »

hi_hi wrote: post #213
throwaway314155 wrote: post #180

Earlier quoted context omitted.

> I don't get the discussions around side project and they're ML engineers, not security experts. Why are you excusing a company for a serious security leak. No one is here as far as I can tell. But if you've ever been a software engineer who is required to work with someone purely from an ML lab and/or academia, you'll quickly discover that "principled software engineering" just isn't really something they consider…

Yeah, you're right, I was conflating the excusing bit. I haven't worked with serious ML engineers, but having worked in large webdev there's usually a team involved in these projects, including senior none devs who would ensure the correct checks and balances are in place before go live. Does this not happen in ML projects? (of course there are always exceptions and unknowns that will slip through, I don't know if th…

> Yeah, you're right, I was conflating the excusing bit.

No worries. :)

> Does this not happen in ML projects?

Consistently? No. At the level of e.g. OpenAI/Anthropic? It is mandatory. These are not just research labs, they're product (ChatGPT, Claude) companies. These American companies have done a reasonable job at hiring for all sorts of skillsets to keep things well rounded.

Perhaps DeepSeek hasn't learned this lesson yet... Or, well - it could be far more complicated than that. Speculating is only so useful with so little information.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#267

Post by mmaunder »

m00x wrote: post #245
mmaunder wrote: post #225

The amount of vitriol in these comments is the really surprising data. I've seen the same on Twitter. I can only put it down to the financial pain DeepSeek inflicted on many US retail investors by wiping almost $700 billion off NVidia's stock price. I think a lot of folks didn't see it coming and it hurt them right where it matters most: In the wallet. The anger out there is very real.

The hit on NVidia's stock price makes no sense to me. DeepSeek uses H100s and H800s. They'll likely have reasons to buy more now, and America will want to compete even harder, buying more chips. American companies are still way ahead as well, but they're just getting more competition. This will be healthy.

I think there was a growing awareness of NVidia's vulnerability and I think that, while I don't agree with his conclusions, Jeffrey Emanuel's excellent piece from the 25th added significantly to that momentum:

https://youtubetranscriptoptimizer.com/blog/05_the_short_cas...

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#268

Post by ipaddr »

pinoy420 wrote: post #171
MobiusHorizons wrote: post #160

Earlier quoted context omitted.

I would consider it table stakes for an intermediate level engineer at a big company (which would have well defined processes for doing this safely) or a senior at any other company (on the assumption some of that infra has to be set up from scratch). If 10 years of experience hadn’t taught me this yet, I would personally be concerned how I’m spending my energy. I am roughly at the 10y mark, and I would estimate I ha…

HN is a bubble. The expectation that your colleagues are /experts like you/ is unrealistic. To stand something up like this, which is entirely on bare metal - this is a task many would find challenging if they are entirely honest with themselves and put their egos to the side. Your typical swe thinks that nothing is impossible. There was a recent comment which said along the lines of “I used to watch figure skating,…

You are talking to the ice skaters. They expect you to do up your laces. Setting a password on a database is a something I would expect of any company capable of asking for a credit card.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#269

Post by teleforce »

jijji wrote: post #256
m00x wrote: post #245

Earlier quoted context omitted.

The hit on NVidia's stock price makes no sense to me. DeepSeek uses H100s and H800s. They'll likely have reasons to buy more now, and America will want to compete even harder, buying more chips. American companies are still way ahead as well, but they're just getting more competition. This will be healthy.

It's probably the lack of understanding the market... Most people thought there was a ban (issued by the US in 2022) against China being able to utilize the H100 Nvidia graphics cards to prevent them from using AI (for the obvious purpose of oppressing their people). If anything, export controls need to be looked at and probably tightened as this is a glaring loop hole.

> export controls need to be looked at and probably tightened as this is a glaring loop hole

US is the prominent trade freedom proponent champion until it does not suits them

Also US is the prominent democracy proponent champion until it does not suits them

And also US is the free speech freedom champion until it does not suits them

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#270

Post by zem »

hdlothia wrote: post #5

This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.

doesn't even need to be a side project, or by a bunch of quants. a bunch of AI researchers working on this as their primary job would still have no real idea about what it takes to secure a large-scale world-usable internet service.
Post reply on HN