47 ms·

Tell HN: Whole Yandex Git repository leaked

602 points by coolspot 4y ago

Someone just published 40Gb+ of leaked Yandex GIT repository. Won’t provide magnet here, but it is top google result for “yandex leak” when filtered by last 24h. Affected services: aapi.tar.bz2 admins.tar.bz2 ads.tar.bz2 alice.tar.bz2 analytics.tar.bz2 antiadblock.tar.bz2 antirobot.tar.bz2 autocheck.tar.bz2 balancer.tar.bz2 billing.tar.bz2 bindings.tar.bz2 captcha.tar.bz2 cdn.tar.bz2 certs.tar.bz2 ci.tar.bz2 classifieds.tar.bz2 client_analytics.tar.bz2 client_method.tar.bz2 cloud.tar.bz2 commerce.tar.bz2 connect.tar.bz2 crm.tar.bz2 crypta.tar.bz2 customer_service.tar.bz2 datacloud.tar.bz2 delivery.tar.bz2 direct.tar.bz2 disk.tar.bz2 docs.tar.bz2 drive.tar.bz2 extsearch.tar.bz2 fuzzing.tar.bz2 gencfg.tar.bz2 groups.tar.bz2 helpdesk.tar.bz2 infra.tar.bz2 intranet.tar.bz2 investors.tar.bz2 it-office.tar.bz2 jupytercloud.tar.bz2 kernel.tar.bz2 library.tar.bz2 load.tar.bz2 mail.tar.bz2 maps.tar.bz2 maps_2.tar.bz2 maps_adv.tar.bz2 market.tar.bz2 metrika.tar.bz2 mobile-WARNING-notfull.tar.bz2 nginx.tar.bz2 noc.tar.bz2 partner.tar.bz2 passport.tar.bz2 pay.tar.bz2 payplatform.tar.bz2 paysys.tar.bz2 portal.tar.bz2 robot.tar.bz2 rt-research.tar.bz2 saas.tar.bz2 sandbox.tar.bz2 search.tar.bz2 security.tar.bz2 skynet.tar.bz2 smart_devices.tar.bz2 smarttv.tar.bz2 solomon.tar.bz2 stocks.tar.bz2 tasklet.tar.bz2 taxi.tar.bz2 tools.tar.bz2 travel.tar.bz2 wmconsole.tar.bz2 yandex_io.tar.bz2 yandex360.tar.bz2 yaphone.tar.bz2 yawe.tar.bz2 frontend.tar.bz2

retro99 4y ago
[dead]
coolspot 4y ago
Notably Yandex.Search, Yandex.Maps, Yandex.Disk (like Google Drive), Yandex.Mail, Yandex.Alice (voice assistant), Yandex.Taxi (like Uber), Yandex.Delivery (like Postmates), Yandex.Drive (like ZipCar), Yandex.Robot (idk, prob advanced AGI from the future), Yandex.Pay (like Google Pay), Yandex.Docs (like Google Docs/Sheets) all source codes leaked.
- exebook 4y ago
  From quick googling(yandexing?) Yandex.Robot appears to be a self driving briefcase.
- llIIllIIllIIl 4y ago
  There you go, really working and scalable solution for running Mail, Storage, Voice assistant and Documents on your infrastructure and not depend on 3rd parties. End of Joke.
- LudwigNagasena 4y ago
  Yandex.Robot is probably a food delivery robot.
  - l11r 4y ago
    Probably it's just a search bot like Googlebot.
    - comonoid 4y ago
      Yandex.Robot is a delivery self-driving robot. The crawler bot is a part of Yandex.Search.
- mickelsen 4y ago
  Now let's ping r/selfhosted to get this working locally and we are all set.
tpmx 4y ago
I was super impressed when I interacted with Yandex ML engineering people like a decade ago on a conf call - they were trying to sell us their services. Very smart and very clearly outward-looking. Haven't followed the company in detail since. Wonder what happened to them. [removed inaccurate details]
- type0 4y ago
  > One wonders if this is revenge from the regime. It's not a revenge of the the regime. A decade ago it was a different company, now they all are completely under the cap of FSB, it's basically a Lubyanka filial. It's serfdom all over again, not that strange it got leaked by some unhappy employee.
  - tpmx 4y ago
    Reading up on the current situation with the company - yeah, I think you're right. :/
  - mahoro 4y ago
    When you're judging them, think about the space of possibilities as well. Is any example of a Russian business of such volume not tied to the government?
    - gyudin 4y ago
      I mean they were pretty much forced to sell business to the government recently. Coincidence? Maybe…
      - eshch 4y ago
        what business and to what government? are you in your dreams?
        andystep 4y ago
        i guess it's about recent exchange of their news service to vk. not literaly sold to the government https://techcrunch.com/2022/09/12/yandex-news-zen-vk-sale-completes https://techcrunch.com/2022/09/12/yandex-news-zen-vk-sale-co...
digianarchist 4y ago
https://breached.vc/Thread-yandex-git-sources https://breached.vc/Thread-yandex-git-sources
- metadat 4y ago
  It wasn't google-able per the OPs instructions, but this did the trick. Thanks digianarchist! Archive links: https://archive.today/h5XJs https://archive.today/h5XJs https://web.archive.org/web/20230125224316/https://breached.vc/Thread-yandex-git-sources https://web.archive.org/web/20230125224316/https://breached....
  - aaron695 4y ago
    [dead]
  - wolfgx 4y ago
    It can be found on Yandex too! https://i.imgur.com/rxYINhF.png https://i.imgur.com/rxYINhF.png
- yandythrowaway 4y ago
  Anyone else's download stuck? I haven't used torrents in forever, not sure if this is normal or if there's a workaround.
  - SXX 4y ago
    Most likely your ISP have throttling for torrent bandwidth. Use VPN.
  - thanatos519 4y ago
    Mine is stuck and my ISP has never throttled anything.
- guilhas 4y ago
  How is this site allowed to be live? Yandex source is cool. But there are a lot of leaks with people private data The US authorities move mountains for TornadoCash, Z-Library, etc... why leave this one?
syntaxing 4y ago
Anyone have insight what “skynet.tar.bz2” is?!
- deleted 4y ago
  [deleted]
- concordance 4y ago
  Assuming Google Translate is accurate, it's a server management solution.
- pshirshov 4y ago
  Skynet is a command execution and metric collection layer used in basic cluster ops. Nothing cool to be honest. Essentially it allows you to run a command on all the hosts matching a predicate. This was the easiest way to disrupt a whole datacenter for those who had enough privileges, I did it at least once. Also several times unnoticed bugs in my code shut down literally everything for noticeable periods of time. I've been developing the search orchestration system.
  - lostmsu 4y ago
    There's no confirmation about the number of machines the script is going to affect?
    - capableweb 4y ago
      Probably, but irrelevant. What you really need is a confirmation if the sent command will lead to bugs/downtime or not. If you think the command is working 100%, why would you say no to run it on 1000s of machines all at once?
    - pshirshov 4y ago
      Yeah, it was extremely easy to fuck up. In some cases though you might have wanted to run something on thousands of hosts to debug a tricky issue. Bad practices, I know.
    - 4y ago
option 4y ago
[flagged]
- nDIgger 4y ago
  [dead]
- ValleZ 4y ago
  Why do you think this way exactly? Yandex did own news service they were forced to take news only from state approved sources but besides that I don't think your statement is correct.
EMIRELADERO 4y ago
Could any kind soul out there upload the repositories to a public git instance?
- spak9 4y ago
  Please!
- capableweb 4y ago
  No? It's 44GB of data. Magnet: magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce Download at your own risk, comes from a brand new user on BreachForums
  - zadrot-lol 4y ago
    magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce
    - wqewqewqe 4y ago
      [dead]
  - nDIgger 4y ago
    [dead]
  - ASalazarMX 4y ago
    It's a joy seeing flags from all the world in the torrent peers. Special mention to Ukraine and Russia itself.
winddude 4y ago
Wow!!
Zetobal 4y ago
Interesting that most of the code comments are in English.
- altmind 4y ago
  i've seen more comments in russian than in english. what's your numbers?
- SV_BubbleTime 4y ago
  Lingua franca with all their contractors most likely.
  - pshirshov 4y ago
    Not at all. People preferred to use english to feel some connection to the world. That was mostly psychological. A Silicon Valley cargo cult if you wish. Also the company always avoided any use of external contractors.
    - viraptor 4y ago
      I think you're reading to much into this. It's easier to not switch languages in one task. If you're using an English-based programming language and English libraries/frameworks, you're not going to name your own variables in a different language. Comments most often follow that too. Any time I see someone attempt that, it's extremely distracting.
      - pshirshov 4y ago
        Not really. I've attended a meeting on the subject where people decided to use English "not to be loosers" and I've heard similar stories from other teams and departments.
        viraptor 4y ago
        And what do they understand by "not be losers" in that case? What are the main ideas behind it?
SeanAnderson 4y ago
What are the short-term and long-term implications of this? I assume a drastically increased attack surface and potentially a boon for open-source development? Anything else?
- winddude 4y ago
  All of those, assuming there's nothing malicious in the code. Google see if any of their code had been stolen, not like they can do much right now.
- capableweb 4y ago
  Probably Yandex will start watching their infrastructure very closely, and go through all known attack vectors that haven't been prioritized before to fix them ASAP. Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it.
  - EMIRELADERO 4y ago
    > Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. With the current geopolitical situation going on, is this really true? (From a western developer's perspective)
    - nyolfen 4y ago
      the US and russia are both parties to the berne convention, the law still applies even if a bunch of misc russian people and orgs had their assets seized
      - EMIRELADERO 4y ago
        It's not about whether it applies, but whether there is any will to enforce it. Would the US government cooperate in the indictment and prosecution of a US citizen, on behalf of a de-facto enemy nation, for a company that has ties and is allegedly controlled by the government of said nation?
imglorp 4y ago
Yandex reverse image search is very good. I use it more than tineye, bing, or goog. It either gives you the exact matches if it can find them, or else it can infer what is desired and show many similar matches.
- SV_BubbleTime 4y ago
  Hmm, didn't know they had one, but I'm let down by Google's 90% of the time so I'll try it next time.
- SanjayMehta 4y ago
  Yandex regular search is very good too, especially at surfacing results which appear to be censored by Google. The only problem is the interface language keeps flipping back to Russian.
  - deleted 4y ago
    [deleted]
  - kilroy123 4y ago
    I agree. I use it when I'm searching for "iso" torrents.
  - account42 4y ago
    Is there a meta search engine that highlights results from Yandex that are missing from or ranked much lower on Google?
    - SanjayMehta 4y ago
      Searx used to highlight the source engine. I don't remember ever seeing yandex though.
- rcfox 4y ago
  I wonder if that's a function of their technology or their database. Google's image search used to be good, but regulations have forced them to cripple it in some ways, and they might have chosen not to surface results in some contexts.
winddude 4y ago
Can anyone confirm there's nothing obviously malicious implanted in the code and they are legit?
- MonkeyMalarky 4y ago
  Why on earth would you execute anything from the dump?
  - Aleksdev 4y ago
    You know why.
    - MonkeyMalarky 4y ago
      No, I really don't
      - Aleksdev 4y ago
        These are various yandex products. Yandex is the Google of Russia, people will run the code out of curiosity alone.
    - winddude 4y ago
      lazy
  - ghostpepper 4y ago
    Well there was a critical git RCE less than 7 days ago that could be triggered by cloning a malicious repo so you might not have to execute anything to get owned
    - drekipus 4y ago
      this is a torrent of a git repo, not using git to clone
      - 4y ago
nDIgger 4y ago
[dead]
from 4y ago
They use p0f for TCP fingerprinting in their nginx config :) Edit: Cool spam factors in extsearch/robot/index/metadoc/lib/links/spam_factors.h: SF_WEB_HOST_RANK = 0, SF_GREEN_TRAFFIC_SHARE_NORMALIZED = 1, SF_ADULTNESS_BETA = 2, SF_NOT_FOUND_RANKS = 3, SF_RANK_DOOR_TUMBLR = 4, SF_NASTY_CONTENT = 5, SF_LANGUAGE = 6, SF_IS_SHOP = 7, SF_WEB_HOST_SIZE = 8, SF_RANK_HACKED_NOVA_PHP = 9, SF_IS_FOREIGN_HOST = 10, SF_PESS_LEVEL = 11, SF_SPAMNESS = 12, SF_NASTY_HOST = 13, SF_MORE_120SEC_VISITS_SHARE = 14, SF_GREEN_TRAFF_SHARE_CORRECT = 15, SF_RESERVED_16 = 16, SF_WEB_RANDOM_LOG_HOST_ERRATUM_LOG_QUERY_PROBABILITY_AVG = 17, SF_RESERVED_18 = 18, SF_WEB_VISITORS_RETURN_MONTH_SHARE = 19, SF_WEB_RANDOM_LOG_HOST_SYNT_QUALITY_AVG = 20, SF_WEB_RU_TRAFF_SHARE = 21, SF_RESERVED_22 = 22, SF_RESERVED_23 = 23, SF_RESERVED_24 = 24, SF_RESERVED_25 = 25, SF_WEB_MORE_160_VISITORS_SHARE = 26, SF_RESERVED_27 = 27, SF_RESERVED_28 = 28, SF_WEB_TOUCH_WIFI_TRAFF_SHARE = 29, SF_WEB_LOG_CTR_MEAN = 30, SF_RESERVED_31 = 31, SF_RESERVED_32 = 32, SF_SPAM_FORMULA_MEDIAN = 33, SF_AVG_GEOV_SQ = 34, SF_AVG_TH3973_SQ = 35, SF_RUS_DOCS_COUNT = 36, SF_AVG_SKACHKI_SOFT_FIX = 37, SF_RANK_MFA_RU_42 = 38, SF_DEV_PFC_TOTAL_LINKS = 39, SF_RANK_DOOR2_2 = 40, SF_AVG_QC_1 = 41, SF_QUERIES_CHAR_LEN = 42, SF_HOST_IMG_CLICKS = 43, SF_AVG_DOORWAY_BIGWEIGHT_NORM = 44, SF_AVG_QS_FTOP_FREQ_IN_ARATIO = 45, SF_HOST_RANK = 46, SF_AVG_TITLE_CAPITAL_LETTERS_RATIO = 47, SF_RANK_COMM_GOODNESS_UA = 48, SF_YABAR_AVG_URL_LEN = 49, SF_MAX_OWNER_QS_RANK = 50, SF_DIFF_MAX_QS_RANK_ON_NUMHOPS_255 = 51, SF_YABAR_SEARCH_VIS_AVG_DEPTH = 52, SF_AVG_QS_F_WND_500_NOFILTER = 53, SF_QUERIES_WORD_LEN = 54, SF_RANK_UNBAN_MX2 = 55, SF_AVG_QS_F_PARA_WORDS_REQ_SQRT_MAX_OF_SUM_WORD_WEIGHT = 56, SF_RANK_ASESSOR_GOODNESS_RELATIVE = 57, SF_RANK_COMM_BAR_GOODNESS_SITE = 58, SF_QUERIES_AVG_TEXT = 59, SF_MIN_QS_DOC_CLASS_QS_RANK_PTH_QUERY_SPAM = 60, SF_SERP_CLICKS_BY_SLASH_PART_2_30 = 61, SF_MAX_QS_DOC_CLASS_QS_RANK_PTH_QUERY_SPAM = 62, SF_RANK_COMM3 = 63, SF_DEV_QS_F_PUNCT_BLANKS_RAT = 64, SF_RANK_UNBAN_MX = 65, SF_FROM_SEARCH_SHARE_NORMALIZED = 66, SF_RANK_XIT_DOOR = 67, SF_AVG_QS_RANK_ON_NOT_SUBDOMAINS_DOCS = 68, SF_AVG_OWNER_QS_RANK = 69, SF_HOST_CLIPART_IMAGE_COUNT = 70, SF_RANK_HACKED_NOVA2 = 71, SF_WEB_RANDOM_LOG_HOST_QI_QUERY_COUNT_AVG = 72, SF_WEB_COMM_LINKS_HOST_CEO = 73, SF_WEB_YABAR_HOST_AVG_TIME2 = 74, SF_LINK_IN_SEO_PART = 75, SF_LAST_PESS_TIME = 76, SF_WEB_OWNER_MEAN_RELEV_MX = 77, SF_NASTY_URL = 78, SF_PAGE_RANK = 79, SF_HAS_MAIN_CONTENT = 80, SF_AVG_SPAM = 81, SF_RANK_ARTROZ = 82, SF_RANK_AGS4 = 83, SF_AVG_NUM_HOPS = 84, SF_MIN_OWNER_QS_RANK = 85, SF_FROM_SEARCH_SHARE_YA_BRO = 86, SF_OWNER_MEAN_RELEV = 87, SF_HOST_FACE_IMAGE_COUNT = 88,
pshirshov 4y ago
Seems like the main repository ("arcadia") isn't there.
- EMIRELADERO 4y ago
  Looked around and it seems like arcadia is a sort of VCS on top of git/a build system? https://github.com/yandex/CMICOT/blob/master/.arcadia.root https://github.com/yandex/CMICOT/blob/master/.arcadia.root
  - pshirshov 4y ago
    When I've been there arcadia was the primary SVN monorepo where everything was stored (and built by custom flavour of cmake). From what I heard it's still SVN and git was completely eradicated in the company.
    - EMIRELADERO 4y ago
      This is pretty interesting to me. Usually companies will gradually switch over to git. This is the first time I've heard of a company using git and ditching it in favor of older technology.
      - ilyaluk 4y ago
        Yandex used (maybe still using) SVN monorepo named Arcadia for most of the source code. As it became too big, they developed an in-house VCS called Arc and were switching to it; there is more context in a presentation about Arc (2020), transcript/recording in Russian[1] I could assume that this is the leak of Arcadia, and each archive roughly contains one top-level folder. [1]: https://habr.com/en/company/yandex/blog/482926/ https://habr.com/en/company/yandex/blog/482926/
      - aflag 4y ago
        Google also uses something close to SVN and explicitly avoids git. I don't think there's any sense of progression between the two. I think it comes down to which one fits your processes better.
rmac 4y ago
% bzgrep "BEGIN PRIVATE KEY" \*.bz2 disk.tar.bz2:Binary file (standard input) matches drive.tar.bz2:Binary file (standard input) matches extsearch.tar.bz2:Binary file (standard input) matches ...
- pshirshov 4y ago
  Nothing surprising. The development culture was shit back there. Though I would expect these keys to be just some stub config values which allowed engineers to quickly run the shit locally.
- corytheboyd 4y ago
  Checked in private keys are fine if they're just used in tests, local development, etc.
  - inhumantsar 4y ago
    Technically fine yes but from a habits and practice standpoint it's safest to stick to a "not ever" rule and work around the limitations.
    - leoh 4y ago
      yolo
    - michens 4y ago
      Care to explain? Keeping private keys inside the repo sounds fine for me as long as these keys are only used for local development, they are rotated regularly and are only valid for localhost (in case of TLS certs).
      - hypeatei 4y ago
        Not GP: If you make it normal to check in credentials and keys, then the risk of accidentally checking in prod secrets increases. It's basically making it comfortable for devs to deal with keys in repos and I think that's inherently dangerous.
thallavajhula 4y ago
A better thing to do is to reach out to their support team or whichever "Contact Us" emails they've got publicly available and let them know
- ztrww 4y ago
  why?
- killingtime74 4y ago
  I think they know at this point
jiggawatts 4y ago
What programming languages are they using mostly?
- nine_k 4y ago
  More refined: what languages beside JS, Python, Java, and C++?
  - deleted 4y ago
    [deleted]
  - animuchan 4y ago
    There's some Go, TypeScript, and the usual frontend stuff.
- from 4y ago
  C++ and Python.
grapesurgeon 4y ago
magnet is on breachforums and 4chan, so if anyone wants to take a look check those places, not to hard to find
DonHopkins 4y ago
Has anyone found the FSB back-door portal?
- kragen 4y ago
  c'mon, don't say that as if you haven't found it
- ranting-moth 4y ago
  Do they need a back door? Won't they just pick up the phone and ask for whatever they want. It isn't like anyone in Ruzzia is going to say 'no' when the FSB calls.
  - Havoc 4y ago
    Everyone can say no. Once.
- GoblinSlayer 4y ago
  I imagine it's just an old good admin panel with a normal login.
- The_Colonel 4y ago
  Yandex cooperates with Russian government, no need for a back door.
scifibestfi 4y ago
That's huge. What takes up most of that 40Gb+?
- deleted 4y ago
  [deleted]
- luciusdomitius 4y ago
  1. It is basically a regional big tech do-it-all company. 2. Git repos tend to get rather large over time and yandex has been around since before git.
  - SXX 4y ago
    There is no git history in leak. Just a lot of code, test data and occasional binaries / ml train data and few pre-trained models.
- xkrt 4y ago
  Yandex tends to store third-party code in their repository. For example you can find sources of Spark here. So some part of 40GB+ code isn't written by Yandex.
- zxcq544 4y ago
  frontend archive takes 18 gb, everything else is like 1-2 gig.
Geee 4y ago
How do companies prevent their employees from leaking code?
- psychphysic 4y ago
  They fire them in the dead of night after cutting off all credentials silently. And hope the Dev didn't have any local code.
- dns_snek 4y ago
  In Russia? An abundance of fragile human-sized windows and "slippery when wet" floors.
SXX 4y ago
If you want to know what's inside archives without downloading them I'm slowly working on my blog post about this breach. Will try to write a bit about affected Yandex services for those who never been interested in russian internet segment. Also uploaded file lists from most of archives: https://arseniyshestakov.com/2023/01/26/yandex-services-source-code-leak/ https://arseniyshestakov.com/2023/01/26/yandex-services-sour...
- rad_gruchalski 4y ago
  I have seen your article. This bit caught my attention: > All files are dated back to 24 February 2022. If a coincidence, pretty interesting.
  - capableweb 4y ago
    In case people aren't aware, that day Russia made a major escalation of the Ukrainian invasion that began back in 2014, starting with the announcement from Putin about a "special military operation" beginning in Ukraine by Russian forces. Unlikely that was the day of download, it's common practice to mask last-modified/last-accessed/created-at timestamps in dumps, by setting it to some significant date or just initial unix timestamp.
    - Slava_Propanei 4y ago
      [dead]
  - deleted 4y ago
    [deleted]
  - Zvez 4y ago
    not a coincidence yandex has its own VCS (called arkadia). But not all services used it, some used github public and private. After war started, they had to migrate everything to internal vcs for obvious reasons. So it makes sense they stopped committing to other repos somewhat around that date. I don't have any inside knowledge now, but my guess would be that the leak is from 'on-prem' github.
htzhcfzubhfjk 4y ago
Ukrainians probably hacked Yandex, because they thought, it is a Russian engine, but it is actually from Netherland/EU. They should be careful, otherwise Netherland will stop helping them with weapons pretty quickly.
- ipaddr 4y ago
  .com is but not .ru
- matrix_overload 4y ago
  It's a Russian company incorporated in Netherlands for the same reason why the Chinese buy real estate in Canada rather than at home.
- bearstrikesback 4y ago
  [dead]
- Nekorosu 4y ago
  your pathetic attempt at humor will be remembered for ages to come
- sereja 4y ago
  You don't need to hack Yandex. The entire monorepostory is synced on every intern's laptop, and you can do whatever your want with the files. I always wondered how it hasn't been leaked before to be honest.
  - wizzwizz4 4y ago
    > The entire monorepostory is synced on every intern's laptop, If they're still using Subversion, why would that be? Subversion lets you check out just part of a repo. (Then again, interns, I guess.)
    - COMMENT___ 4y ago
      1. Subversion lets you configure granular permissions. 2. Subversion lets you check out portions of your repository. 3. Subversion working copy does not have all regions history. Just a snapshot of the checked out revision. So at least Subversion would have allowed them to limit the amount of leaked data + no revision history leaked.
phendrenad2 4y ago
Sadly building a maps app, or a search engine, is more about getting lots of data than it is about code. But I do hope that this can be used in arguments, such as saying "We should do it X way because that's what Yandex does!"
- ddorian43 4y ago
  > or a search engine I would guess the crawling to be the easiest part.
  - mdaniel 4y ago
    Maybe "easiest" in the "I can explain it to my mother" way, but as with many good things, the devil's in the details about that. That goes double now that Cloudflare have basically taken over some non-trivial portion of the Internet and they really do hate crawlers I have a theory that the big search engines have agreements in place for "side-channel" access to CF and Akamai POPs but I would guess none of the parties involved have any incentive to discuss such a thing in a place that I could read it
    - ddorian43 4y ago
      Cloudflare probably whitelists google/bing/etc. Hell, there are many sites that work with whitelists themselves. It's still the easiest part. > but I would guess none of the parties involved have any incentive to discuss such a thing in a place that I could read it This reminds me how all the tech sites banned people like Alex Jones simultaneously. It's collusion.
ogurechny 4y ago
Note that Yandex currently seems to be made of “Yandex teams relocated out of the country” (say, 1/5th of the company, I don't have exact numbers), “Yandex teams inside the country”, and “Yandex brand services sold to other company”, so the internal access situation is complex.
- thinkingemote 4y ago
  I imagine a combination of COVID and the Ukraine War has contributed to a change in access security policies.
EVa5I7bHFq9mnYK 4y ago
Could be useful for taxi drivers to figure out how to get the surge fares.
- tazjin 4y ago
  Recently when I take Yandex taxi, the drivers have regularly been asking me if I would tell them how much the price displayed to me was and what fare level I selected (the second question I find surprising, as the app description makes it sound like except for maybe Комфорт/Комфорт+ the cars are _not_ the same). The discrepancies vary quite a lot (and not in the driver's favour) ... I've never gotten this question before, so maybe Yandex has gotten more aggressive in how they treat drivers recently?
throwaway290 4y ago
Curious. On one hand, Yandex being the biggest IT company and inevitably close to Russian gov, an anti-Russia ex employee could do this in protest after leaving country and company since the latest war started (I know people who did). But on the other hand I heard Yandex was planning to relocate completely to an EU country, which seems like distancing from Russian government, and then it could be an attack by pro-Putin hacktivists.
- tryauuum 4y ago
  as a russian, when I read "Yandex was planning to relocate completely to an EU country" I feel that it's obvious that it's not possible for it to relocate completely. Yet, I cannot explain why... allegedly the fear of government is so big that in the beginning of the war management in internal meetings said something like "If we publish real news about the war then it will be our 5 minutes of glory, and then the company will cease to exist"
  - throwaway290 4y ago
    I know cases where it did happen...
nathancahill 4y ago
This whole "build in the open" stuff has gone too far.
- dmitriid 4y ago
  Is this the future OSS enthusiasts want?! * shakes fist *
  - dym_sh 4y ago
    open source --force
- dym_sh 4y ago
  real town-square-coding vibes
- GoblinSlayer 4y ago
  Some intentionally publish sources for audit and compatibility purpose, still proprietary though.
  - londons_explore 4y ago
    I'm really surprised more companies don't do this... Simply make the whole code repo public on github, but don't give any license to allow anyone else to use it. You get 90% of the kudos for being opensource-friendly, while no serious sized company can just clone your code and steal all your business.
deleted 4y ago
[deleted]
psychphysic 4y ago
Is there any highlights? Like any ML that can be run locally or neat code?
- neongreen 4y ago
  The repo contains the entire logic for the Alice smart assistant (kinda like Siri but more cheeky). They only parse Russian and Turkish I think, so the parser/tokenizer/etc would have to be replaced if you wanted to steal and repurpose it for another language, but the rest could probably be translated and you’d get a working production-grade smart assistant for somewhat cheap-ish.
totetsu 4y ago
username = "warwish" Well..
lapaz17 4y ago
To whose downloaded, is there a documentation for them?
nnurmanov 4y ago
Last year was a record data leak year for Russia, quote “We can say that last year the data of 75% of all residents of Russia leaked” - DLBI https://vc.ru/services/586078-mozhno-skazat-chto-v-proshlom-godu-utekli-dannye-75-vseh-zhiteley-rossii-dlbi https://vc.ru/services/586078-mozhno-skazat-chto-v-proshlom-...
quazar 4y ago
magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce

602 points by coolspot 4y ago

retro99 4y ago

[dead]

coolspot 4y ago

Notably Yandex.Search, Yandex.Maps, Yandex.Disk (like Google Drive), Yandex.Mail, Yandex.Alice (voice assistant), Yandex.Taxi (like Uber), Yandex.Delivery (like Postmates), Yandex.Drive (like ZipCar), Yandex.Robot (idk, prob advanced AGI from the future), Yandex.Pay (like Google Pay), Yandex.Docs (like Google Docs/Sheets) all source codes leaked.

exebook 4y ago
From quick googling(yandexing?) Yandex.Robot appears to be a self driving briefcase.
llIIllIIllIIl 4y ago
There you go, really working and scalable solution for running Mail, Storage, Voice assistant and Documents on your infrastructure and not depend on 3rd parties. End of Joke.
LudwigNagasena 4y ago
Yandex.Robot is probably a food delivery robot.
- l11r 4y ago
  Probably it's just a search bot like Googlebot.
  - comonoid 4y ago
    Yandex.Robot is a delivery self-driving robot. The crawler bot is a part of Yandex.Search.
mickelsen 4y ago
Now let's ping r/selfhosted to get this working locally and we are all set.

tpmx 4y ago

I was super impressed when I interacted with Yandex ML engineering people like a decade ago on a conf call - they were trying to sell us their services. Very smart and very clearly outward-looking. Haven't followed the company in detail since. Wonder what happened to them. [removed inaccurate details]

type0 4y ago
> One wonders if this is revenge from the regime. It's not a revenge of the the regime. A decade ago it was a different company, now they all are completely under the cap of FSB, it's basically a Lubyanka filial. It's serfdom all over again, not that strange it got leaked by some unhappy employee.
- tpmx 4y ago
  Reading up on the current situation with the company - yeah, I think you're right. :/
- mahoro 4y ago
  When you're judging them, think about the space of possibilities as well. Is any example of a Russian business of such volume not tied to the government?
  - gyudin 4y ago
    I mean they were pretty much forced to sell business to the government recently. Coincidence? Maybe…
    - eshch 4y ago
      what business and to what government? are you in your dreams?
      - andystep 4y ago
        i guess it's about recent exchange of their news service to vk. not literaly sold to the government https://techcrunch.com/2022/09/12/yandex-news-zen-vk-sale-completes https://techcrunch.com/2022/09/12/yandex-news-zen-vk-sale-co...

digianarchist 4y ago

https://breached.vc/Thread-yandex-git-sources https://breached.vc/Thread-yandex-git-sources

metadat 4y ago
It wasn't google-able per the OPs instructions, but this did the trick. Thanks digianarchist! Archive links: https://archive.today/h5XJs https://archive.today/h5XJs https://web.archive.org/web/20230125224316/https://breached.vc/Thread-yandex-git-sources https://web.archive.org/web/20230125224316/https://breached....
- aaron695 4y ago
  [dead]
- wolfgx 4y ago
  It can be found on Yandex too! https://i.imgur.com/rxYINhF.png https://i.imgur.com/rxYINhF.png
yandythrowaway 4y ago
Anyone else's download stuck? I haven't used torrents in forever, not sure if this is normal or if there's a workaround.
- SXX 4y ago
  Most likely your ISP have throttling for torrent bandwidth. Use VPN.
- thanatos519 4y ago
  Mine is stuck and my ISP has never throttled anything.
guilhas 4y ago
How is this site allowed to be live? Yandex source is cool. But there are a lot of leaks with people private data The US authorities move mountains for TornadoCash, Z-Library, etc... why leave this one?

syntaxing 4y ago

Anyone have insight what “skynet.tar.bz2” is?!

deleted 4y ago
[deleted]
concordance 4y ago
Assuming Google Translate is accurate, it's a server management solution.
pshirshov 4y ago
Skynet is a command execution and metric collection layer used in basic cluster ops. Nothing cool to be honest. Essentially it allows you to run a command on all the hosts matching a predicate. This was the easiest way to disrupt a whole datacenter for those who had enough privileges, I did it at least once. Also several times unnoticed bugs in my code shut down literally everything for noticeable periods of time. I've been developing the search orchestration system.
- lostmsu 4y ago
  There's no confirmation about the number of machines the script is going to affect?
  - capableweb 4y ago
    Probably, but irrelevant. What you really need is a confirmation if the sent command will lead to bugs/downtime or not. If you think the command is working 100%, why would you say no to run it on 1000s of machines all at once?
  - pshirshov 4y ago
    Yeah, it was extremely easy to fuck up. In some cases though you might have wanted to run something on thousands of hosts to debug a tricky issue. Bad practices, I know.
  - 4y ago

option 4y ago

[flagged]

nDIgger 4y ago
[dead]
ValleZ 4y ago
Why do you think this way exactly? Yandex did own news service they were forced to take news only from state approved sources but besides that I don't think your statement is correct.

EMIRELADERO 4y ago

Could any kind soul out there upload the repositories to a public git instance?

spak9 4y ago
Please!
capableweb 4y ago
No? It's 44GB of data. Magnet: magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce Download at your own risk, comes from a brand new user on BreachForums
- zadrot-lol 4y ago
  magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce
  - wqewqewqe 4y ago
    [dead]
- nDIgger 4y ago
  [dead]
- ASalazarMX 4y ago
  It's a joy seeing flags from all the world in the torrent peers. Special mention to Ukraine and Russia itself.

winddude 4y ago

Wow!!

Zetobal 4y ago

Interesting that most of the code comments are in English.

altmind 4y ago
i've seen more comments in russian than in english. what's your numbers?
SV_BubbleTime 4y ago
Lingua franca with all their contractors most likely.
- pshirshov 4y ago
  Not at all. People preferred to use english to feel some connection to the world. That was mostly psychological. A Silicon Valley cargo cult if you wish. Also the company always avoided any use of external contractors.
  - viraptor 4y ago
    I think you're reading to much into this. It's easier to not switch languages in one task. If you're using an English-based programming language and English libraries/frameworks, you're not going to name your own variables in a different language. Comments most often follow that too. Any time I see someone attempt that, it's extremely distracting.
    - pshirshov 4y ago
      Not really. I've attended a meeting on the subject where people decided to use English "not to be loosers" and I've heard similar stories from other teams and departments.
      - viraptor 4y ago
        And what do they understand by "not be losers" in that case? What are the main ideas behind it?

SeanAnderson 4y ago

What are the short-term and long-term implications of this? I assume a drastically increased attack surface and potentially a boon for open-source development? Anything else?

winddude 4y ago
All of those, assuming there's nothing malicious in the code. Google see if any of their code had been stolen, not like they can do much right now.
capableweb 4y ago
Probably Yandex will start watching their infrastructure very closely, and go through all known attack vectors that haven't been prioritized before to fix them ASAP. Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it.
- EMIRELADERO 4y ago
  > Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. With the current geopolitical situation going on, is this really true? (From a western developer's perspective)
  - nyolfen 4y ago
    the US and russia are both parties to the berne convention, the law still applies even if a bunch of misc russian people and orgs had their assets seized
    - EMIRELADERO 4y ago
      It's not about whether it applies, but whether there is any will to enforce it. Would the US government cooperate in the indictment and prosecution of a US citizen, on behalf of a de-facto enemy nation, for a company that has ties and is allegedly controlled by the government of said nation?

imglorp 4y ago

Yandex reverse image search is very good. I use it more than tineye, bing, or goog. It either gives you the exact matches if it can find them, or else it can infer what is desired and show many similar matches.

SV_BubbleTime 4y ago
Hmm, didn't know they had one, but I'm let down by Google's 90% of the time so I'll try it next time.
SanjayMehta 4y ago
Yandex regular search is very good too, especially at surfacing results which appear to be censored by Google. The only problem is the interface language keeps flipping back to Russian.
- deleted 4y ago
  [deleted]
- kilroy123 4y ago
  I agree. I use it when I'm searching for "iso" torrents.
- account42 4y ago
  Is there a meta search engine that highlights results from Yandex that are missing from or ranked much lower on Google?
  - SanjayMehta 4y ago
    Searx used to highlight the source engine. I don't remember ever seeing yandex though.
rcfox 4y ago
I wonder if that's a function of their technology or their database. Google's image search used to be good, but regulations have forced them to cripple it in some ways, and they might have chosen not to surface results in some contexts.

winddude 4y ago

Can anyone confirm there's nothing obviously malicious implanted in the code and they are legit?

MonkeyMalarky 4y ago
Why on earth would you execute anything from the dump?
- Aleksdev 4y ago
  You know why.
  - MonkeyMalarky 4y ago
    No, I really don't
    - Aleksdev 4y ago
      These are various yandex products. Yandex is the Google of Russia, people will run the code out of curiosity alone.
  - winddude 4y ago
    lazy
- ghostpepper 4y ago
  Well there was a critical git RCE less than 7 days ago that could be triggered by cloning a malicious repo so you might not have to execute anything to get owned
  - drekipus 4y ago
    this is a torrent of a git repo, not using git to clone
    - 4y ago

nDIgger 4y ago

[dead]

from 4y ago

They use p0f for TCP fingerprinting in their nginx config :) Edit: Cool spam factors in extsearch/robot/index/metadoc/lib/links/spam_factors.h: SF_WEB_HOST_RANK = 0, SF_GREEN_TRAFFIC_SHARE_NORMALIZED = 1, SF_ADULTNESS_BETA = 2, SF_NOT_FOUND_RANKS = 3, SF_RANK_DOOR_TUMBLR = 4, SF_NASTY_CONTENT = 5, SF_LANGUAGE = 6, SF_IS_SHOP = 7, SF_WEB_HOST_SIZE = 8, SF_RANK_HACKED_NOVA_PHP = 9, SF_IS_FOREIGN_HOST = 10, SF_PESS_LEVEL = 11, SF_SPAMNESS = 12, SF_NASTY_HOST = 13, SF_MORE_120SEC_VISITS_SHARE = 14, SF_GREEN_TRAFF_SHARE_CORRECT = 15, SF_RESERVED_16 = 16, SF_WEB_RANDOM_LOG_HOST_ERRATUM_LOG_QUERY_PROBABILITY_AVG = 17, SF_RESERVED_18 = 18, SF_WEB_VISITORS_RETURN_MONTH_SHARE = 19, SF_WEB_RANDOM_LOG_HOST_SYNT_QUALITY_AVG = 20, SF_WEB_RU_TRAFF_SHARE = 21, SF_RESERVED_22 = 22, SF_RESERVED_23 = 23, SF_RESERVED_24 = 24, SF_RESERVED_25 = 25, SF_WEB_MORE_160_VISITORS_SHARE = 26, SF_RESERVED_27 = 27, SF_RESERVED_28 = 28, SF_WEB_TOUCH_WIFI_TRAFF_SHARE = 29, SF_WEB_LOG_CTR_MEAN = 30, SF_RESERVED_31 = 31, SF_RESERVED_32 = 32, SF_SPAM_FORMULA_MEDIAN = 33, SF_AVG_GEOV_SQ = 34, SF_AVG_TH3973_SQ = 35, SF_RUS_DOCS_COUNT = 36, SF_AVG_SKACHKI_SOFT_FIX = 37, SF_RANK_MFA_RU_42 = 38, SF_DEV_PFC_TOTAL_LINKS = 39, SF_RANK_DOOR2_2 = 40, SF_AVG_QC_1 = 41, SF_QUERIES_CHAR_LEN = 42, SF_HOST_IMG_CLICKS = 43, SF_AVG_DOORWAY_BIGWEIGHT_NORM = 44, SF_AVG_QS_FTOP_FREQ_IN_ARATIO = 45, SF_HOST_RANK = 46, SF_AVG_TITLE_CAPITAL_LETTERS_RATIO = 47, SF_RANK_COMM_GOODNESS_UA = 48, SF_YABAR_AVG_URL_LEN = 49, SF_MAX_OWNER_QS_RANK = 50, SF_DIFF_MAX_QS_RANK_ON_NUMHOPS_255 = 51, SF_YABAR_SEARCH_VIS_AVG_DEPTH = 52, SF_AVG_QS_F_WND_500_NOFILTER = 53, SF_QUERIES_WORD_LEN = 54, SF_RANK_UNBAN_MX2 = 55, SF_AVG_QS_F_PARA_WORDS_REQ_SQRT_MAX_OF_SUM_WORD_WEIGHT = 56, SF_RANK_ASESSOR_GOODNESS_RELATIVE = 57, SF_RANK_COMM_BAR_GOODNESS_SITE = 58, SF_QUERIES_AVG_TEXT = 59, SF_MIN_QS_DOC_CLASS_QS_RANK_PTH_QUERY_SPAM = 60, SF_SERP_CLICKS_BY_SLASH_PART_2_30 = 61, SF_MAX_QS_DOC_CLASS_QS_RANK_PTH_QUERY_SPAM = 62, SF_RANK_COMM3 = 63, SF_DEV_QS_F_PUNCT_BLANKS_RAT = 64, SF_RANK_UNBAN_MX = 65, SF_FROM_SEARCH_SHARE_NORMALIZED = 66, SF_RANK_XIT_DOOR = 67, SF_AVG_QS_RANK_ON_NOT_SUBDOMAINS_DOCS = 68, SF_AVG_OWNER_QS_RANK = 69, SF_HOST_CLIPART_IMAGE_COUNT = 70, SF_RANK_HACKED_NOVA2 = 71, SF_WEB_RANDOM_LOG_HOST_QI_QUERY_COUNT_AVG = 72, SF_WEB_COMM_LINKS_HOST_CEO = 73, SF_WEB_YABAR_HOST_AVG_TIME2 = 74, SF_LINK_IN_SEO_PART = 75, SF_LAST_PESS_TIME = 76, SF_WEB_OWNER_MEAN_RELEV_MX = 77, SF_NASTY_URL = 78, SF_PAGE_RANK = 79, SF_HAS_MAIN_CONTENT = 80, SF_AVG_SPAM = 81, SF_RANK_ARTROZ = 82, SF_RANK_AGS4 = 83, SF_AVG_NUM_HOPS = 84, SF_MIN_OWNER_QS_RANK = 85, SF_FROM_SEARCH_SHARE_YA_BRO = 86, SF_OWNER_MEAN_RELEV = 87, SF_HOST_FACE_IMAGE_COUNT = 88,

pshirshov 4y ago

Seems like the main repository ("arcadia") isn't there.

EMIRELADERO 4y ago
Looked around and it seems like arcadia is a sort of VCS on top of git/a build system? https://github.com/yandex/CMICOT/blob/master/.arcadia.root https://github.com/yandex/CMICOT/blob/master/.arcadia.root
- pshirshov 4y ago
  When I've been there arcadia was the primary SVN monorepo where everything was stored (and built by custom flavour of cmake). From what I heard it's still SVN and git was completely eradicated in the company.
  - EMIRELADERO 4y ago
    This is pretty interesting to me. Usually companies will gradually switch over to git. This is the first time I've heard of a company using git and ditching it in favor of older technology.
    - ilyaluk 4y ago
      Yandex used (maybe still using) SVN monorepo named Arcadia for most of the source code. As it became too big, they developed an in-house VCS called Arc and were switching to it; there is more context in a presentation about Arc (2020), transcript/recording in Russian[1] I could assume that this is the leak of Arcadia, and each archive roughly contains one top-level folder. [1]: https://habr.com/en/company/yandex/blog/482926/ https://habr.com/en/company/yandex/blog/482926/
    - aflag 4y ago
      Google also uses something close to SVN and explicitly avoids git. I don't think there's any sense of progression between the two. I think it comes down to which one fits your processes better.

rmac 4y ago

% bzgrep "BEGIN PRIVATE KEY" \*.bz2 disk.tar.bz2:Binary file (standard input) matches drive.tar.bz2:Binary file (standard input) matches extsearch.tar.bz2:Binary file (standard input) matches ...

pshirshov 4y ago
Nothing surprising. The development culture was shit back there. Though I would expect these keys to be just some stub config values which allowed engineers to quickly run the shit locally.
corytheboyd 4y ago
Checked in private keys are fine if they're just used in tests, local development, etc.
- inhumantsar 4y ago
  Technically fine yes but from a habits and practice standpoint it's safest to stick to a "not ever" rule and work around the limitations.
  - leoh 4y ago
    yolo
  - michens 4y ago
    Care to explain? Keeping private keys inside the repo sounds fine for me as long as these keys are only used for local development, they are rotated regularly and are only valid for localhost (in case of TLS certs).
    - hypeatei 4y ago
      Not GP: If you make it normal to check in credentials and keys, then the risk of accidentally checking in prod secrets increases. It's basically making it comfortable for devs to deal with keys in repos and I think that's inherently dangerous.

thallavajhula 4y ago

A better thing to do is to reach out to their support team or whichever "Contact Us" emails they've got publicly available and let them know

ztrww 4y ago
why?
killingtime74 4y ago
I think they know at this point

jiggawatts 4y ago

What programming languages are they using mostly?

nine_k 4y ago
More refined: what languages beside JS, Python, Java, and C++?
- deleted 4y ago
  [deleted]
- animuchan 4y ago
  There's some Go, TypeScript, and the usual frontend stuff.
from 4y ago
C++ and Python.

grapesurgeon 4y ago

magnet is on breachforums and 4chan, so if anyone wants to take a look check those places, not to hard to find

DonHopkins 4y ago

Has anyone found the FSB back-door portal?

kragen 4y ago
c'mon, don't say that as if you haven't found it
ranting-moth 4y ago
Do they need a back door? Won't they just pick up the phone and ask for whatever they want. It isn't like anyone in Ruzzia is going to say 'no' when the FSB calls.
- Havoc 4y ago
  Everyone can say no. Once.
GoblinSlayer 4y ago
I imagine it's just an old good admin panel with a normal login.
The_Colonel 4y ago
Yandex cooperates with Russian government, no need for a back door.

scifibestfi 4y ago

That's huge. What takes up most of that 40Gb+?

deleted 4y ago
[deleted]
luciusdomitius 4y ago
1. It is basically a regional big tech do-it-all company. 2. Git repos tend to get rather large over time and yandex has been around since before git.
- SXX 4y ago
  There is no git history in leak. Just a lot of code, test data and occasional binaries / ml train data and few pre-trained models.
xkrt 4y ago
Yandex tends to store third-party code in their repository. For example you can find sources of Spark here. So some part of 40GB+ code isn't written by Yandex.
zxcq544 4y ago
frontend archive takes 18 gb, everything else is like 1-2 gig.

Geee 4y ago

How do companies prevent their employees from leaking code?

psychphysic 4y ago
They fire them in the dead of night after cutting off all credentials silently. And hope the Dev didn't have any local code.
dns_snek 4y ago
In Russia? An abundance of fragile human-sized windows and "slippery when wet" floors.

SXX 4y ago

If you want to know what's inside archives without downloading them I'm slowly working on my blog post about this breach. Will try to write a bit about affected Yandex services for those who never been interested in russian internet segment. Also uploaded file lists from most of archives: https://arseniyshestakov.com/2023/01/26/yandex-services-source-code-leak/ https://arseniyshestakov.com/2023/01/26/yandex-services-sour...

rad_gruchalski 4y ago
I have seen your article. This bit caught my attention: > All files are dated back to 24 February 2022. If a coincidence, pretty interesting.
- capableweb 4y ago
  In case people aren't aware, that day Russia made a major escalation of the Ukrainian invasion that began back in 2014, starting with the announcement from Putin about a "special military operation" beginning in Ukraine by Russian forces. Unlikely that was the day of download, it's common practice to mask last-modified/last-accessed/created-at timestamps in dumps, by setting it to some significant date or just initial unix timestamp.
  - Slava_Propanei 4y ago
    [dead]
- deleted 4y ago
  [deleted]
- Zvez 4y ago
  not a coincidence yandex has its own VCS (called arkadia). But not all services used it, some used github public and private. After war started, they had to migrate everything to internal vcs for obvious reasons. So it makes sense they stopped committing to other repos somewhat around that date. I don't have any inside knowledge now, but my guess would be that the leak is from 'on-prem' github.

htzhcfzubhfjk 4y ago

Ukrainians probably hacked Yandex, because they thought, it is a Russian engine, but it is actually from Netherland/EU. They should be careful, otherwise Netherland will stop helping them with weapons pretty quickly.

ipaddr 4y ago
.com is but not .ru
matrix_overload 4y ago
It's a Russian company incorporated in Netherlands for the same reason why the Chinese buy real estate in Canada rather than at home.
bearstrikesback 4y ago
[dead]
Nekorosu 4y ago
your pathetic attempt at humor will be remembered for ages to come
sereja 4y ago
You don't need to hack Yandex. The entire monorepostory is synced on every intern's laptop, and you can do whatever your want with the files. I always wondered how it hasn't been leaked before to be honest.
- wizzwizz4 4y ago
  > The entire monorepostory is synced on every intern's laptop, If they're still using Subversion, why would that be? Subversion lets you check out just part of a repo. (Then again, interns, I guess.)
  - COMMENT___ 4y ago
    1. Subversion lets you configure granular permissions. 2. Subversion lets you check out portions of your repository. 3. Subversion working copy does not have all regions history. Just a snapshot of the checked out revision. So at least Subversion would have allowed them to limit the amount of leaked data + no revision history leaked.

phendrenad2 4y ago

Sadly building a maps app, or a search engine, is more about getting lots of data than it is about code. But I do hope that this can be used in arguments, such as saying "We should do it X way because that's what Yandex does!"

ddorian43 4y ago
> or a search engine I would guess the crawling to be the easiest part.
- mdaniel 4y ago
  Maybe "easiest" in the "I can explain it to my mother" way, but as with many good things, the devil's in the details about that. That goes double now that Cloudflare have basically taken over some non-trivial portion of the Internet and they really do hate crawlers I have a theory that the big search engines have agreements in place for "side-channel" access to CF and Akamai POPs but I would guess none of the parties involved have any incentive to discuss such a thing in a place that I could read it
  - ddorian43 4y ago
    Cloudflare probably whitelists google/bing/etc. Hell, there are many sites that work with whitelists themselves. It's still the easiest part. > but I would guess none of the parties involved have any incentive to discuss such a thing in a place that I could read it This reminds me how all the tech sites banned people like Alex Jones simultaneously. It's collusion.

ogurechny 4y ago

Note that Yandex currently seems to be made of “Yandex teams relocated out of the country” (say, 1/5th of the company, I don't have exact numbers), “Yandex teams inside the country”, and “Yandex brand services sold to other company”, so the internal access situation is complex.

thinkingemote 4y ago
I imagine a combination of COVID and the Ukraine War has contributed to a change in access security policies.

EVa5I7bHFq9mnYK 4y ago

Could be useful for taxi drivers to figure out how to get the surge fares.

tazjin 4y ago
Recently when I take Yandex taxi, the drivers have regularly been asking me if I would tell them how much the price displayed to me was and what fare level I selected (the second question I find surprising, as the app description makes it sound like except for maybe Комфорт/Комфорт+ the cars are _not_ the same). The discrepancies vary quite a lot (and not in the driver's favour) ... I've never gotten this question before, so maybe Yandex has gotten more aggressive in how they treat drivers recently?

throwaway290 4y ago

Curious. On one hand, Yandex being the biggest IT company and inevitably close to Russian gov, an anti-Russia ex employee could do this in protest after leaving country and company since the latest war started (I know people who did). But on the other hand I heard Yandex was planning to relocate completely to an EU country, which seems like distancing from Russian government, and then it could be an attack by pro-Putin hacktivists.

tryauuum 4y ago
as a russian, when I read "Yandex was planning to relocate completely to an EU country" I feel that it's obvious that it's not possible for it to relocate completely. Yet, I cannot explain why... allegedly the fear of government is so big that in the beginning of the war management in internal meetings said something like "If we publish real news about the war then it will be our 5 minutes of glory, and then the company will cease to exist"
- throwaway290 4y ago
  I know cases where it did happen...

nathancahill 4y ago

This whole "build in the open" stuff has gone too far.

dmitriid 4y ago
Is this the future OSS enthusiasts want?! * shakes fist *
- dym_sh 4y ago
  open source --force
dym_sh 4y ago
real town-square-coding vibes
GoblinSlayer 4y ago
Some intentionally publish sources for audit and compatibility purpose, still proprietary though.
- londons_explore 4y ago
  I'm really surprised more companies don't do this... Simply make the whole code repo public on github, but don't give any license to allow anyone else to use it. You get 90% of the kudos for being opensource-friendly, while no serious sized company can just clone your code and steal all your business.

deleted 4y ago

[deleted]

psychphysic 4y ago

Is there any highlights? Like any ML that can be run locally or neat code?

neongreen 4y ago
The repo contains the entire logic for the Alice smart assistant (kinda like Siri but more cheeky). They only parse Russian and Turkish I think, so the parser/tokenizer/etc would have to be replaced if you wanted to steal and repurpose it for another language, but the rest could probably be translated and you’d get a working production-grade smart assistant for somewhat cheap-ish.

totetsu 4y ago

username = "warwish" Well..

lapaz17 4y ago

To whose downloaded, is there a documentation for them?

nnurmanov 4y ago

Last year was a record data leak year for Russia, quote “We can say that last year the data of 75% of all residents of Russia leaked” - DLBI https://vc.ru/services/586078-mozhno-skazat-chto-v-proshlom-godu-utekli-dannye-75-vseh-zhiteley-rossii-dlbi https://vc.ru/services/586078-mozhno-skazat-chto-v-proshlom-...

quazar 4y ago

magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce