It’s a feature, not a bug !
Exposed DeepSeek database leaking sensitive information, including chat history
91–100 of 499 posts
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#92This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle. Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.
how many people in the world are used to deploying external client facing applications?
Hundreds of thousands. My employer alone probably has 1000.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#93Earlier quoted context omitted.
Someone who worked on a non-English environment years ago here: sometimes you do use the local language in some contexts, but, more often than not, you end up using English for the majority of stuff since it's a bit off-putting to mix another language with the English of programming languages and APIs.
Dumb question, but it would then seem that you have to know English to program??
Not literally required, because languages typically support UTF-8 source files, but it would be difficult to use most popular software libraries without being able to at least read English.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#94Earlier quoted context omitted.
Dumb question, but it would then seem that you have to know English to program??
It’s harder to learn for sure. Majority of the resources are in English and it’s harder to internalise the keywords. But it’s definitely possible to program without knowing English.
But like, you can’t program Java without English right? A for-loop has to be written in English?? I’m so confused haha
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#95Earlier quoted context omitted.
A bunch of ML researchers who were initially hired to do quant work published their first ever user facing project. So maybe not a side project, but if you have ever worked with ML researchers before, lack of engineering/security chops shouldn't be that surprising to you.
> A bunch of ML researchers who were initially hired to do quant work Very interesting! I'm sure you have a source for this claim? This myth of DS being a side project literally started from one tweet. DeepSeek the company is funded by a company whose main business is being a hedge fund, but DeepSeek itself from day 1 has been all about building LLM to reach AGI, completely independent. This is like saying SpaceX is…
A valid response to my initial comment which was a bit tongue in cheek.
However, i'm not sure that them being LLM researchers compared to quant researchers changes the dynamic of their relaxed security posture.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#96This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
It's very uncomfortable to switch languages during development. Think how often you would need to switch languages if you use Chinese for column names and such. English has been the second language for Chinese for the past 30 or so years. I started to learn Enginse from Grade 4, and nowadays they started in kindergarten.
However, I suspect it's a honey pot.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#97Earlier quoted context omitted.
> This kinda does support the 'DeepSeek is the side project of a bunch of quants' angle Can we stop with this nonsense ? The list of author of the paper is public, you can just go look it up. There are ~130 people on the ML team, they have regular ML background just like you would find at any other large ML labs. Their infra cost multiple millions of dollar per month to run, and the salary of such a big team is somew…
A bunch of ML researchers who were initially hired to do quant work published their first ever user facing project. So maybe not a side project, but if you have ever worked with ML researchers before, lack of engineering/security chops shouldn't be that surprising to you.
well security isn't their job to begin with
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#98Earlier quoted context omitted.
Dumb question, but it would then seem that you have to know English to program??
Not literally required, because languages typically support UTF-8 source files, but it would be difficult to use most popular software libraries without being able to at least read English.
Now I want to program in Mandarin and be l33t
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#99This doesn't look like a responsible disclosure, at all. ed: I was wrong!
From the article: > The Wiz Research team immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure. Assuming everything mentioned in the article was fixed before publication, I don’t see an issue with it.
Yeah my bad I missed that and edited OP.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#100This is probably an incredibly stupid, off-topic question, but why are their database schemas and logs in English? Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools? I'm realizing no…
Someone who worked on a non-English environment years ago here: sometimes you do use the local language in some contexts, but, more often than not, you end up using English for the majority of stuff since it's a bit off-putting to mix another language with the English of programming languages and APIs.
Yep, myself as well. I've heard non-English programmers who've worked with non-English codebases call them "very weird".