Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data accidentally exposed by Microsoft AI researchers

wiz.io

Post reply on HN
Print view View original

91–100 of 238 posts

Re: Data accidentally exposed by Microsoft AI researchers

#91

Post by mymac »

_jal wrote: post #88
mymac wrote: post #46

Earlier quoted context omitted.

Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.

Let me tell you about the laptop connected to our network with a cellular antenna we found in a locked filing cabinet after getting a much-delayed forced-door alert. This, after some social engineering attempts that displayed unnerving familiarity with employees and a lot of virtual doorknob-rattling. They may be rare, but "real" pentests are still a thing.

Ouch. How did that ended up?

Re: Data accidentally exposed by Microsoft AI researchers

#92

Post by manojlds »

bootloop wrote: post #83
hdesh wrote: post #9

On a lighter note - I saw a chat message that started with "Hey dude! How is it going". I'm disappointed that the response was not https://nohello.net/en/ .

This is quite funny for me because at first I didn't understand what the problem is. In German, if you ask this question, it is expected that your question is genuine and you can expect an answer (Although usually people don't use this opportunity to unload there emotional package, but it can happen!) Whereas in Englisch you assume this is just a hello and nothing more.

In England people say "You all right" and move on without even waiting for a response!

Re: Data accidentally exposed by Microsoft AI researchers

#93

Post by dylan604 »

LinuxBender wrote: post #59
heywhatupboys wrote: post #49

Earlier quoted context omitted.

what does this have to do with a "modem" per se?

The parent comment was about the movie Wargames and the questionable security of the 80's that is still in use today . That security in Wargames was a modem that provided access to a subsystem of the WOPR mainframe named "Joshua" . Joshua had super-user privs on the mainframe. It was likely meant to be a temporary means for the system architect to monitor and improve the system after it was deployed but then life cha…

i still love the phreaking scene trying to make a phone call where he uses the can pull tab to ground the phone. it was more of a phreaker vibe than trying to whistle into the phone or social engineer an operator or just happening to have a dialer on him.

Re: Data accidentally exposed by Microsoft AI researchers

#94

Post by mymac »

j245 wrote: post #75
mymac wrote: post #46

Earlier quoted context omitted.

Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.

From my understanding as a non security expert: Pentest comes across more as checking all the common attack vectors don’t exist. Getting out of bed to do the so-called “real stuff” is typically called a bug bounty program or security researching. Both exist and I don’t see why most companies couldn’t start a bug bounty program if they really cared a lot about the “real stuff”

> From my understanding as a non security expert:

That certainly helps.

Re: Data accidentally exposed by Microsoft AI researchers

#95

Post by fnordpiglet »

zuminator wrote: post #42
sillysaurusx wrote: post #35

Earlier quoted context omitted.

(Where are you finding friends with a NAS? Or at all, for that matter… guess I’ll look on eBay.) Thank you for the details, particularly about zfs, which I know nothing about. The “if I’m lucky” part piqued my interest. HN was recently taken down by a double disk failure, which is exponentially more likely when you buy drives in bulk - the default case. So being able to survive two failures simultaneously is somethin…

Interesting. It's been a while since I've used eBay, but man they've really upped their game if you can buy friends there now.

OP was pulling your leg a bit. Clearly the only friends folks like us have with NAS are the friends here on HN posting about their NAS.

Re: Data accidentally exposed by Microsoft AI researchers

#96

Post by chinchilla2020 »

hedora wrote: post #82
saurik wrote: post #38

A number of replies here are noting (correctly) how this doesn't have much to do with AI (despite some sentences in this article kind of implicating it; the title doesn't really, fwiw) and is more of an issue with cloud providers, confusing ways in which security tokens apply to data being shared publicly, and dealing with big data downloads (which isn't terribly new)... ...but one notable way in which it does implic…

Occasionally, I’ll talk to someone suggesting a dynamically typed language (or stringly-typed java) for a very large scale (in developer count) security or mission critical application. This incident is a good one to point back to.

What is the best practice? I'm assuming something that isn't a programming language object...

Re: Data accidentally exposed by Microsoft AI researchers

#97

Post by jklehm »

bunderbunder wrote: post #80
quickthrower2 wrote: post #67

Two of the things that make me cringe are mentioned. Pickle files and SAS tokens. I get nervous dealing with Azure storage. Use RBAC. They should depreciate SAS and account keys IMO. SOC2 type auditing should have been done here so I am surprised of the reach. Having the SAS with no expiry and then the deep level of access it gave including machine backups with their own tokens. A lot of lack of defence in depth goin…

Pickle files are cringe, but they're also basically unavoidable when working with Python machine learning infrastructure. None of the major ML packages provide a proper model serialization/deserialization mechanism. In the case of scikit-learn, the code implementing some components does so much crazy dynamic shit that it might not even be feasible to provide a well-engineered serde mechanism without a major rewrite.…

ONNX[0], model-as-protosbufs, continuing to gain adoption will hopefully solve this issue.

[0] https://github.com/onnx/onnx

Re: Data accidentally exposed by Microsoft AI researchers

#98

Post by aftbit »

sillysaurusx wrote: post #35
aftbit wrote: post #23

Earlier quoted context omitted.

Not the OP but I have a pair of Chenbro NR12000 1U rack mount servers, bought for about $120 each on eBay a few years ago. Each has 12 internal 3.5" mounting points and 14 SATA cables. In one server, I have 12 4TB used enterprise drives. In the other, I have 12 8TB drives. Both have 16 GB of RAM (should probably be more) and two 2.5" SATA SSDs. They are configured with two ZFS raidz1 vdevs, each made up of 6 disks. T…

(Where are you finding friends with a NAS? Or at all, for that matter… guess I’ll look on eBay.) Thank you for the details, particularly about zfs, which I know nothing about. The “if I’m lucky” part piqued my interest. HN was recently taken down by a double disk failure, which is exponentially more likely when you buy drives in bulk - the default case. So being able to survive two failures simultaneously is somethin…

Ah my tech friends have specialized into hardware a bit. At least two of us have server racks in our basement, and basically nobody I know (who at least knows the command line) does not have at least a few drives in an old Linux server somewhere.

If you are concerned about reliability above performance, I would suggest using a single raidz2 vdev instead. This would allow the cluster to definitely survive two disks worth of failure. I'll also echo the common mantra - RAID is not backups. If you really need the data, you need to store a second copy offline in a different place.

When I lived in California and did not have room for a server rack, I had a single home server with an 8-bay tower case. I used an LSI card with 2 SAS-to-4x-SATA ports to connect all 8 drives to the machine. I believe I had 6 TB drives in that NAS, though they are currently all out of my house (part of one of my offsite backups now). My topology there was 4x mirror vdevs, which gave me worst case endurance of 1 failure but best case of 4 failures, and at about 4x the IOPS performance, but with the cost of only 50% storage efficiency vs the 75% you would get with raidz2.

There is even raidz3 if you are very paranoid, which allows up to 3 disks to fail before you lose the vdev. I've never used it. As I understand, the parity calculations get considerably more complicated, although I don't know if that really matters.

Re: Data accidentally exposed by Microsoft AI researchers

#99

Post by mxz3000 »

bunderbunder wrote: post #80
quickthrower2 wrote: post #67

Two of the things that make me cringe are mentioned. Pickle files and SAS tokens. I get nervous dealing with Azure storage. Use RBAC. They should depreciate SAS and account keys IMO. SOC2 type auditing should have been done here so I am surprised of the reach. Having the SAS with no expiry and then the deep level of access it gave including machine backups with their own tokens. A lot of lack of defence in depth goin…

Pickle files are cringe, but they're also basically unavoidable when working with Python machine learning infrastructure. None of the major ML packages provide a proper model serialization/deserialization mechanism. In the case of scikit-learn, the code implementing some components does so much crazy dynamic shit that it might not even be feasible to provide a well-engineered serde mechanism without a major rewrite.…

at work we use the ONNX serialisation format for all of our prod models. Those get loaded by the ONNX runtime for inference. works great.

perhaps it's be viable to add support for the ONNX format even for use cases like model checkpointing during training, etc ?

Re: Data accidentally exposed by Microsoft AI researchers

#100

Post by j245 »

mymac wrote: post #94
j245 wrote: post #75

Earlier quoted context omitted.

From my understanding as a non security expert: Pentest comes across more as checking all the common attack vectors don’t exist. Getting out of bed to do the so-called “real stuff” is typically called a bug bounty program or security researching. Both exist and I don’t see why most companies couldn’t start a bug bounty program if they really cared a lot about the “real stuff”

> From my understanding as a non security expert: That certainly helps.

What a shame, HackerNews typically has more insightful comments than garbage like this.

Edit: thanks to everyone who wrote some insightful responses, and there are indeed many. Faith in HackerNews restored !

Post reply on HN