This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
[deleted]
Exposed DeepSeek database leaking sensitive information, including chat history
71–80 of 499 posts
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#72This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
> Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools?
I'm a native English speaker, but from looking at various code bases written by people who aren't, I gather that it's basically this. It wasn't too long ago that one couldn't even reliably feed non-ASCII comments to a lot of compilers, let alone variable and function names.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#73This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
Almost all software engineers learn a passing amount of English - truly localized programming environments are quite esoteric and not really available for most mainstream use cases I can think of.
Depending on the company culture and policy, the most common thing to see is a mix of English variable and function names with native-language comments. Occasionally you will see native-language variable and function names. This is much more common in Latin character set languages (especially among Spanish and Portuguese speakers) in my experience; almost all Chinese code seems to use approximately-English variable and function names.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#74So much effort in trying to tarnish DeepSeek the last 24hrs
It would be incredibly immature and naive to presume that the data fed to this service is not going to be data mined by the CCP.
Downvoted - because of course the CCP wouldn't want all of this data, that's preposterous. What would they even do with it? /S
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#75This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
DeepSeek isn’t a side project or just a bunch of quants - these are part of the marketing that people keep repeating blindly for some reason. To build DeepSeek probably requires at least a $1B+ budget. Between their alleged 50,000 H100 GPUs, expensive (and talented) staff, and the sheer cost of iterating across numerous training runs - it all adds up to far, far more than their highly dubious claim of $5.5M. Anyone s…
Some academic projects have a lot of funding and what they are researching is some top tier stuff.
But the software? Absolute disaster.
When people say DeepSeek is a side project, this is what I assume they mean. It's different when a bunch of software engineers make something with terrible security because it's their main job. With bunch of academics (and no offense to academics), software is not their main job. You could be working on teaching them how to use version control.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#76Earlier quoted context omitted.
That used to be the default setup for Redis, too. Might still be. You aren’t supposed to have it on a public subnet.
> You aren’t supposed to have it on a public subnet. That's an incredibly bad assumption. To have defaults assume that you are on a protected network (what does that even mean? like what permissions are assumed just because you are on the same network? admin?) is just bad practice.
Private networking for internal things like databases has been the standard best practice for a long, long time.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#77open exposed clickhouse is this decade's open exposed elasticsearch so common in the past
Which was originally the open exposed mongo server, then mysql/phpmyadmin, then exposed ftp, and then exposed telnet.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#78Earlier quoted context omitted.
Why is ClickHouse exposing unauthenticated database access at port 9000 to the public? Is this the default behavior or did DeepSeek open it up for dev purposes?
I don't have personal experience but from a quick google it looks like default setup is to accept connections on localhost only [0], and there's a default user without capability to run SQL statements. They would have had to open remote connections and enable SQL capability for the default user (it looks like this is the first step to creating other users, the 3rd step is, removing SQL capability for default user.) […
I imagine it wouldn't necessarily require their opening of remote connections, just a misconfigured reverse proxy.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#79Earlier quoted context omitted.
> This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle Can we stop with this nonsense ? The list of author of the paper is public, you can just go look it up. There are ~130 people on the ML team, they have regular ML background just like you would find at any other large ML labs. Their infra cost multiple millions of dollar per month to run, and the salary of such a big team is somew…
A bunch of ML researchers who were initially hired to do quant work published their first ever user facing project. So maybe not a side project, but if you have ever worked with ML researchers before, lack of engineering/security chops shouldn't be that surprising to you.
> A bunch of ML researchers who were initially hired to do quant work
Very interesting! I'm sure you have a source for this claim?
This myth of DS being a side project literally started from one tweet. DeepSeek the company is funded by a company whose main business is being a hedge fund, but DeepSeek itself from day 1 has been all about building LLM to reach AGI, completely independent.
This is like saying SpaceX is the side-project of a few caremaking bros, just because Elon funded and manages both. They are unrelated.
Again, you can easily google the name of the authors and look at their background, you will find people with PhD in LLM/multimodal models, internships at Microsoft Research etc. No trace of background on quant or time series prediction or any of that.
From the mouth of the CEO himself 2 years ago: "Our large-model project is unrelated to our quant and financial activities. We’ve established an independent company called DeepSeek, to focus on this." [0]
It's really interesting to see how after 10 years debating the mythical 10x engineer, we have now overnight created the mythical 100x Chinese quant bro researcher, that can do 50x better models than the best U.S. people, after 6pm while working on his side project.
[0]: https://www.chinatalk.media/p/deepseek-from-hedge-fund-to-fr...
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#80This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
how many people in the world are used to deploying external client facing applications?