xAI dev leaks API key for private SpaceX, Tesla LLMs • Hacker News Board

Re: xAI dev leaks API key for private SpaceX, Tesla LLMs

#81

Post by _ea1k » Tue, May 06, 2025, 8:35 PM UTC

Zanfa wrote: post #22

_ea1k wrote: post #3

Musk has been talking about integrating Grok into Tesla cars and also adding a lot of space and rocketry specific training. It is completely possible that these models were trained on data that would logically be public at some point. It is also possible that the author's guess is right and that these were to contain sensitive data. Noone really knows, but honestly, these kinds of mistakes are happening all the time.…

How would you accidentally leak your .ssh dir on Github?

It was just an example. It used to be fairly common for people to sync some of their dotfiles via git, and from time to time someone would leak a directory that contained sensitive data without them realizing it. I'd guess things like tokens used by cli tools were more common than whole .ssh directories, but I'm sure both happened.

Not quite the same thing, but also a leak: https://blog.gitguardian.com/github-exposed-private-ssh-key/

I guess all these folks saying professionals would never make a mistake like this will also have insulting names for github engineers. :shrug

Re: xAI dev leaks API key for private SpaceX, Tesla LLMs

#82

Post by _ea1k » Wed, May 07, 2025, 2:15 PM UTC

everforward wrote: post #56

tazjin wrote: post #47

Earlier quoted context omitted.

People with workflows like `git add .; git commit -m 'fix'` can push wondrous things to public repos.

You would have to have a git repo in .ssh or higher up the tree for that to work. Otherwise you’d get one of the “directory is not a repo” messages.

It isn't that uncommon to sync a home dir with git: https://askubuntu.com/questions/1316229/is-it-bad-practice-t...

I'd guess that most of us wouldn't do it by just "git init" in the home directory. There are many safer ways than that.

But we were all newbs once, and often even the newbs have access to various keys and credentials.

Re: xAI dev leaks API key for private SpaceX, Tesla LLMs

#83

Post by threecheese » Mon, May 12, 2025, 11:03 PM UTC

erulabs wrote: post #70

threecheese wrote: post #69

The biggest surprise to me was: “administration officials told some U.S. government employees that DOGE is using AI to surveil at least one federal agency’s communications for hostility to President Trump and his agenda”. I understand that there’s no expectation of privacy at work (especially in govt), and everything you write is “on the record”; however an employer monitoring comms for what’s essentially thoughtcrim…

Yes but it's worth understanding the executive branch (which according to this administration includes all federal agencies), in its constitutional form, is more or less just an extension of the president. Conceptually they all "perform at the pleasure of" the person of the president. The "balance" and "disagreement" can happen outside of the executive, in the legislative or judicial branches. Definitely not how I wo…

Fair, and valid. I suppose in the case of a normal organization, leadership’s constraint is keeping enough good employees to be commercially viable. If your goal is to reduce the size and scope of your organization no matter the impact, that constraint is irrelevant.