Live data from Hacker News

Exposed DeepSeek database leaking sensitive information, including chat history

wiz.io

61–70 of 499 posts

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#61
post #28
post #6

So much effort in trying to tarnish DeepSeek the last 24hrs

Maybe, but having dev services outside of VPN is pretty nuts, not much effort needed to find that . Wouldn't expect a company with such budgets be that careless, I'm sure it's only the tip of the iceberg.

One more proof that AGI is not near

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#62
This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English?

Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools?

I'm realizing now that I'm very ignorant when it comes to non English-based software engineering.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#63
post #5

This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.

DeepSeek isn’t a side project or just a bunch of quants - these are part of the marketing that people keep repeating blindly for some reason. To build DeepSeek probably requires at least a $1B+ budget. Between their alleged 50,000 H100 GPUs, expensive (and talented) staff, and the sheer cost of iterating across numerous training runs - it all adds up to far, far more than their highly dubious claim of $5.5M. Anyone s…

> To build DeepSeek probably requires at least a $1B+ budget. Between their alleged 50,000 H100 GPUs, expensive (and talented) staff, and the sheer cost of iterating across numerous training runs - it all adds up to far, far more than their highly dubious claim of $5.5M.

This is not fair. Is OpenAI, for example, including the CEO paycheck for the model training costs?

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#64
post #5

This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.

DeepSeek isn’t a side project or just a bunch of quants - these are part of the marketing that people keep repeating blindly for some reason. To build DeepSeek probably requires at least a $1B+ budget. Between their alleged 50,000 H100 GPUs, expensive (and talented) staff, and the sheer cost of iterating across numerous training runs - it all adds up to far, far more than their highly dubious claim of $5.5M. Anyone s…

> Anyone spending that amount of money isn’t just doing a side project.

You're reciting a bunch of absolute numbers, without any sort of context at all. $5M isn't the same for every company. For example, in 2020, it seems High Flyer spent a casual $27M on a supercomputer. They later replaced that with a $138M new computer. $5.5M sounds like something that could be like a side-project for a company like that, whose blood and sweat is literally money.

> But this degree of failure raises lots of questions whether such companies can ever be trusted.

This, I agree with though. I wouldn't trust sending my data over to them. Using their LLMs though, on my own hardware? Don't mind if I do, as long as it's better, I don't really mind what country it is imported from.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#65
post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

Someone who worked on a non-English environment years ago here: sometimes you do use the local language in some contexts, but, more often than not, you end up using English for the majority of stuff since it's a bit off-putting to mix another language with the English of programming languages and APIs.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#66

Earlier quoted context omitted.

Why is ClickHouse exposing unauthenticated database access at port 9000 to the public? Is this the default behavior or did DeepSeek open it up for dev purposes?

I don't have personal experience but from a quick google it looks like default setup is to accept connections on localhost only [0], and there's a default user without capability to run SQL statements. They would have had to open remote connections and enable SQL capability for the default user (it looks like this is the first step to creating other users, the 3rd step is, removing SQL capability for default user.) […

when deployed to kubernetes you will have to open up to remote conns (thats how they were using it)

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#67
post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

The languages and frameworks and documentation are often in English. The code has a good chance of also being in English as a result.

See also: aviation.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#68
post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

I worked at a Chinese company for a while and they used Chinese in meetings but English in the code base.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#69
post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

> Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools?

That is precisely what happens. It is not unusual for code and databases to be written in English, even when the developers are from a non-English speaking country. Think about it: the toolchain, programming language and libraries are all based on English anyway.

Re: Exposed DeepSeek database leaking sensitive information, including chat history

#70
post #62

This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…

Most Chinese open source code I've seen is written in English, with English variable names, but comments in Chinese Unicode glyphs (in between all the buffer overflows and other general carelessness).

Don't forget Shenzhen is a stone's throw away from Hong Kong where English is widely spoken.

Post reply on HN