Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

Post reply on HN
Print view View original

411–420 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#411

Post by gitaarik »

suraci wrote: post #204

that's why i never use my strong passwords in many chinese websites(in fact, i tend not to use passwords in any website) i suggest you guys don't do that also this industry in china is so young, many devs and orgs don't understand what will happened if they shutdown the firewall or expose their database on the internet without a password they just, can't think of it, need someone to remind them

I didn't understand your comment first, because I use a password manager which generates a unique and complicated password for each website I setup an account for. So I never reuse any password. So if one one those sites gets hacked and my password is potentially exposed, it doesn't matter, because I only use that password there.

I would recommend that. Bitwarden is a pretty good open-source password manager. You can install it as a plugin in your browser, so it can fill out your password for you so you don't have to manually copy and paste.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#412

Post by TeMPOraL »

pjc50 wrote: post #405
londons_explore wrote: post #128

Earlier quoted context omitted.

Interestingly, in the world of electronics this used to be true too. The first Diode on a circuit board would be marked "D1", no matter which country produced it. Datasheets for components would be in english. Any text on a circuit board would be in english (ie. "Voltage Select Switch" or "Copyright 2025".). However, a few years back it became common for most datasheets to be available in mandarin and english, and th…

> this year most PCB fabrication houses have gained support for putting Chinese characters onto a circuit board I've yet to see one of these in the wild, but it sounds cool to me and I would like to see it. There's something of a problem the CJK languages have in not being able to do abbreviations or acronyms, so in Japanese you will occasionally see a couple of Latin letters standing out because that's much shorter…

> in Japanese you will occasionally see a couple of Latin letters standing out

I mostly encounter this watching anime, and I feel it stands out more than it should. It's not just the sudden shift to an entirely different family of glyphs - the overall typography feels off. There's room for improvement here.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#413

Post by chromanoid »

nemoniac wrote: post #399
jvansc wrote: post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

Not only that, DeepSeek "thinks" in English! When I interact with it by asking it a question in Spanish, the parts between the ... are in English before it goes on to answer in Spanish. Give it a try in your favourite language. I went on to ask it if it "thinks" in English, Spanish or Chinese but it just gives the pat answer that, being an LLM, it doesn't think in any language.

I assume that there is a prompt that asks the LLM to generate its thoughts. This prompt is probably in English.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#414

Post by arkh »

lawn wrote: post #381
bryanrasmussen wrote: post #356

Earlier quoted context omitted.

I have worked in a couple places where some of the code was not in English, and it was incredibly annoying, like an affectation.

As a Swede I sometimes encounter new programmers using Swedish instead of English and it's incredibly jarring. It's a little bit better if only the comments are in Swedish but it's still annoying... Luckily it's very rare.

Until you start working on a code base made for something local only and with domain specific words. So much joy trying to remember how some word was translated for your code when a user reports a bug or ask for some new feature.

Bonus point when the people who decided to use English words are also all proud of their "DDD" architecture.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#415

Post by dreilide »

nemoniac wrote: post #399
jvansc wrote: post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

Not only that, DeepSeek "thinks" in English! When I interact with it by asking it a question in Spanish, the parts between the ... are in English before it goes on to answer in Spanish. Give it a try in your favourite language. I went on to ask it if it "thinks" in English, Spanish or Chinese but it just gives the pat answer that, being an LLM, it doesn't think in any language.

interestingly that hasn't been my experience. did you use their web interface or the API?

https://ibb.co/chYPXNDw

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#417

Post by maitola »

haeffin wrote: post #209
maitola wrote: post #207

How do we know for sure that DeepSeek is not actually trained on Nvidia chips? Did someone outside of China replicated the training from scratch (Spending $6M)?

They themselves said it was trained on NVIDIA chips, so I’m not sure where you got that it wasn’t. It was trained on the less capable versions sold for the Chinese market.

I see, thank you for pointing that out. Then I’d rephrase, how do we know for sure that it wasn’t trained on the most advanced Nvidia chips? Did anyone outside of China replicated the training?

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#418

Post by TeMPOraL »

miki123211 wrote: post #329
caust1c wrote: post #148

Earlier quoted context omitted.

Seems that you're right! Also, not that I doubted they were using OpenAI, but searching for `"finish_reason"` on the web all point to openai docs. Personally, I wouldn't say it's a very common attribute to see in logs generally. https://platform.openai.com/docs/api-reference/introduction Right there in the docs: > Now that you've generated your first chat completion, let's break down the response object. We can see t…

> not that I doubted they were using OpenAI The OpenAI API is basically the gold-standard for all kinds of LLM companies and tools, both closed and open source, regardless of whether the underlying model is trained on OpenAI or not.

Not just the gold-standard, but also a de-facto standard - most of the proprietary and OSS tools I've seen that let you configure LLMs only implement support for OpenAI-compatible endpoints.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#419

Post by dreilide »

xinayder wrote: post #392
smallerize wrote: post #295

Earlier quoted context omitted.

That's not the DeepSeek R1 model that they're offering via the API on these servers. That's a Qwen model that's been fine-tuned on output from the big R1 model.

Source?

https://huggingface.co/deepseek-ai/DeepSeek-R1-Distill-Qwen-...

DeepSeek-R1-Distill-Qwen-1.5B, DeepSeek-R1-Distill-Qwen-7B, DeepSeek-R1-Distill-Qwen-14B and DeepSeek-R1-Distill-Qwen-32B are derived from Qwen-2.5 series, which are originally licensed under Apache 2.0 License, and now finetuned with 800k samples curated with DeepSeek-R1. DeepSeek-R1-Distill-Llama-8B is derived from Llama3.1-8B-Base and is originally licensed under llama3.1 license. DeepSeek-R1-Distill-Llama-70B is derived from Llama3.3-70B-Instruct and is originally licensed under llama3.3 license.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#420

Post by leftcenterright »

galnagli wrote: post #352

Thank you everyone, this was responsibly disclosed to DeepSeek and published after the issue was remediated, we got acknowledgment from their team today on our contribution.

were these "dev" domains holding real production data? the blog post does not clear it for me.
Post reply on HN