Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

Post reply on HN
Print view View original

321–330 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#321

Post by mdaniel »

ziddoap wrote: post #259
mmaunder wrote: post #228

Earlier quoted context omitted.

omg dude it literally says that in the code: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

https://www.justice.gov/opa/pr/department-justice-announces-... > The Department of Justice today announced the revision of its policy regarding charging violations of the Computer Fraud and Abuse Act (CFAA). The policy for the first time directs that good-faith security research should not be charged. Good faith security research means accessing a computer solely for purposes of good-faith testing, investigation, an…

AIUI "policy" is not "law," and are subject to the whims of the current leadership in the DoJ

Then again, it's my opinion that "law" isn't "law" if one has enough lawyers

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#322

Post by ninetyninenine »

icepat wrote: post #100
rcruzeiro wrote: post #65

Earlier quoted context omitted.

Someone who worked on a non-English environment years ago here: sometimes you do use the local language in some contexts, but, more often than not, you end up using English for the majority of stuff since it's a bit off-putting to mix another language with the English of programming languages and APIs.

Yep, myself as well. I've heard non-English programmers who've worked with non-English codebases call them "very weird".

A lot of software design from the English world centers around "design patterns." And these "design patterns" have advanced nomenclature and often make things more convoluted then necessary. The whole concept of these "patterns" are actually an arbitrary style that got invented in the English speaking world. In non-english countries people program in ways that are more straightforward.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#323

Post by achillean »

ceejayoz wrote: post #36
nyclounge wrote: post #21

Earlier quoted context omitted.

Why is ClickHouse exposing unauthenticated database access at port 9000 to the public? Is this the default behavior or did DeepSeek open it up for dev purposes?

That used to be the default setup for Redis, too. Might still be. You aren’t supposed to have it on a public subnet.

It's not anymore! They actually changed their defaults and it helped tremendously to reduce the exposure of Redis instances on the Internet.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#324

Post by cratermoon »

jvansc wrote: post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

The Soviet Union is the only country I know that programmed extensively in non-English languages. The Soviets had a Russian-language implementation of ALGOL 68. They also, as best I understand, still use a Russian version of a language called 1C.

https://en.wikipedia.org/wiki/Non-English-based_programming_...

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#325

Post by ebfe1 »

danielodievich wrote: post #29

open exposed clickhouse is this decade's open exposed elasticsearch so common in the past

AFAIK, Opensource Elasticsearch does not offer any form of authentication upon installation for many years but ClickHouse does and in fact I'm often surprised at how many authentication mechanisms were introduced over the years and can be easily configured:

- Password authentication (bcrypt, sha256 hashes) - Certificate authentication (Fantastic for server to server communication) - SSH key authentication (Personally, this is my favourite - every database should have this authentication mechanism to make it easy for Dev to work with)

Not very popular but LDAP and Http Authentication Server are also great options.

I also wonder how DeepSeek engineers deployed their ClickHouse instance. When I deployed using yum/apt install, the installation step literally ask you to input a default password.

And if you were to set it up manually with ClickHouse binary, the out-of-the-box config seal the instance from external network access and the default user is only exposed to localhost as explained by Alex here - https://news.ycombinator.com/item?id=42871371#42873446.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#326

Post by miki123211 »

david-gpu wrote: post #69
jvansc wrote: post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

> Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? That is precisely what happens. It is not unusual for code and databases to be written in English, even when the developers are from a non-English speaking country. Think about it: the toolchain, programming language and libraries are all based on English anyway.

In my experience, you usually get English variable names / db schemas, localized chats and tickets, with internal docs, log messages and comments being a mixed bag.

For some kinds of software, localized names make a lot more sense, e.g. when you're dealing with very subtle distinctions between legal terms that don't have direct English equivalents.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#327

Post by ghfhghg »

jvansc wrote: post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

That's my experience working in Asia. All the comments were in Japanese though

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#328

Post by etrautmann »

ninetyninenine wrote: post #322
icepat wrote: post #100

Earlier quoted context omitted.

Yep, myself as well. I've heard non-English programmers who've worked with non-English codebases call them "very weird".

A lot of software design from the English world centers around "design patterns." And these "design patterns" have advanced nomenclature and often make things more convoluted then necessary. The whole concept of these "patterns" are actually an arbitrary style that got invented in the English speaking world. In non-english countries people program in ways that are more straightforward.

Can you provide an example?

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#329

Post by miki123211 »

caust1c wrote: post #148
pedrovhb wrote: post #118

Earlier quoted context omitted.

> but most probably was training data to prevent deepseek from completing such prompts, evidenced by the `"finish_reason":"stop"` included in the span attributes As I understand, the finish reason being “stop” in API responses usually means the AI ended the output normally. In any case, I don't see how training data could end up in production logs, nor why they'd want to prevent such data (a prompt you'd expect to se…

Seems that you're right! Also, not that I doubted they were using OpenAI, but searching for `"finish_reason"` on the web all point to openai docs. Personally, I wouldn't say it's a very common attribute to see in logs generally. https://platform.openai.com/docs/api-reference/introduction Right there in the docs: > Now that you've generated your first chat completion, let's break down the response object. We can see t…

> not that I doubted they were using OpenAI

The OpenAI API is basically the gold-standard for all kinds of LLM companies and tools, both closed and open source, regardless of whether the underlying model is trained on OpenAI or not.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#330

Post by brookst »

saturn8601 wrote: post #178
henry2023 wrote: post #167

Earlier quoted context omitted.

With the amount of complexity found in modern car's pre-packaged software I'd not be so sure.

No he is right, hardware manufacturers treat software as a line item and just part of the BOM. Typically just contracted out (although some are trying to change that) Thats why its typically mediocre from companies outside of SV. You need a software first agile mentality from the leadership of the company on downwards and these legacy companies just dont have it.

The problem with hardware companies is they’re bad at software because the disciplines are so different that what works for one doesn’t work for the other.

The problem with software companies is they’re bad at hardware for the same reason.

User experience companies can be good at both. Maybe not as good at hardware as a hardware company, maybe not as good at software as software companies.

Apple’s the obvious example, but Google, Garmin, heck even Starbucks are also good examples. Start with the user experience, build hardware of software or whatever else is needed. Specializing in a tool has value, but limits you to that tool.

Post reply on HN