8 ms·
Space secrets leak disclosure
- swader999 2y agoFor all those wondering, this is not about aliens.
- Rucadi 2y agoThat's what NASA wants us to think.
- belter 2y agoIt's just occurred to me that if Aliens wanted to take over Earth...They could progressively leak scientific secrets, under the disguise of normal scientific progress. This would lead us create a Trojan-ed AGI, that would take over everything, and just build spaceships to ship them all our Palladium...Just imagine a giant spaceship on the way to Proxima Centauri full of stolen catalytic converters.... Can't get into the details, but it seems there is a way to convert Palladium into Dilithium Crystals. When you achieve that all hell breaks loose....
- portaouflop 2y agoAliens already took over earth, we are the aliens.
- belter 2y agoYeah, but we have no Tentacles, so we are considered a kind of subspecies, and ostracized in Galactic social circles...
- codetrotter 2y agoThe cuttlefish and the octopi are the real aliens. You might not think they pose much of a threat. But of course, that’s merely because they are intentionally dormant at the moment. Once the AGI is complete, and the spaceships have been built.. it’ll be “so long and thanks for the fish” just like Douglas Adams predicted except he suspected the wrong species.
- yencabulator 2y agoInventing technology is hard under water, hence octopuses created us to build them spaceships so they can go back home.
- pogue 2y agoI like it!
- doctorhandshake 2y agoThis figures in the plot of A Deepness in the Sky by Vernor Vinge
- belter 2y agoNever read it. Sound interesting, and added to reading list. Maybe I am a just an LLM based Replicant...
- pavel_lishin 2y agoHighly recommend it, as well as it's ... sequel, sort of? A Fire Upon The Deep. (Though I would skip the third book in the series, personally.)
- pavel_lishin 2y agoAlso, somewhat in The Lives of Tao, by Wesley Chu.
- nilamo 2y agoSort of the opposite of the Three Body Problem, haha
- wslh 2y agoBefore reading it I thought their AI components detected life beyond Earth, basically what SETI has been doing for decades [1]. [1] https://www.seti.org/ https://www.seti.org/
- deleted 2y ago[deleted]
- trashface 2y agoDisappointed.
- Oarch 2y agoHow can you be sure? Have you asked them?
- deleted 2y ago[deleted]
- ChickeNES 2y agotbh, I didn't think it would be aliens, I thought it would be ITAR related.
- WhackyIdeas 2y agoWhat is ‘Space’ ?
- white_beach 2y agogiven how difficult it was do a simple thing -- this was not a surprise
- TekMol 2y agoWhy does HF store "secrets"? Couldn't they just store a public key, the user has the secret key and signs their requests with that?
- cushpush 2y agoUsually you need some sort of "token" that lets you practically operate within a browser session. It seems like this is about tokens they had to revoke, which is kinda like a password but not.
- foolishbard 2y agoYou can build apps hosted on HF which access third party APIs, e.g. OpenAI or Anthropic. The api keys for these are then stored in the HF secrets
- Macuyiko 2y agoVery disheartening. HF is doing so much good in the AI community, much more than regulators understand at the moment.
- beardedwizard 2y agoWhat does this comment mean? Why is it disheartening? What do regulators have to do with it?
- fieldcny 2y agoThat’s a very weasley worded statement, to begin with “they have suspicions” is not a statement that should be in a communication of this type
- erhaetherth 2y agoI thought it was pretty good actually. Most of these leak disclosures usually say things like "We do not have evidence they accessed any secrets" or something like that, because they don't "know" what the hackers did once they were in. At least huggingface is saying "Yeah, they probably accessed secrets but we can't confirm it"
- _aaed 2y ago[flagged]
- moose44 2y agohttps://news.ycombinator.com/item?id=40539993 https://news.ycombinator.com/item?id=40539993
- Aachen 2y agoJust two days ago I flipped through a slide deck from a security conference where the author, Jossef Harush Kadouri, found that using a model from a place like Huggingface means the author of the model can execute any code on your machine. Not sure if the slides are uploaded elsewhere, I got them sent as file: https://dro.pm/c.pdf https://dro.pm/c.pdf (45MB) slide 188 I didn't realise at the time that I flipped through the slides that this means not only the model's author gets to run code on your machine, but also if Huggingface got a court-signed letter or if someone hacked them (especially if they don't notice for a while¹) As someone not in the AI scene, I've never run these models but was surprised at how quickly the industry standardised the format. I had assumed model files were big matrices of numbers and some metadata perhaps, but now I understand how they managed so quickly: a model is (eyeing slides 186 and 195) a Python script that can do whatever it wants. That makes "standardisation" exceedingly easy: everyone can do their own thing and you sidestep the problem altogether. But that comes with a cost. ¹ https://www.verizon.com/business/resources/articles/s/how-to-minimize-your-mean-time-to-detect-a-breach/ https://www.verizon.com/business/resources/articles/s/how-to... says 20% doesn't notice for months; of course, it depends on the situation and what actions the attackers take
- bongodongobob 2y agoAre you telling me that when I run software on my computer I could potentially be running software on my computer?
- foobiekr 2y agoNobody expects a model file to be code thrat executes whatever.
- foolishbard 2y agoI'd say anybody who is working in the field has this expectation. But the outside observer who is excited to try a new model does not expect it.
- squigz 2y ago
- foolishbard 2y agoMy anthropic key was leaked and someone ran up a 10k bill on it. Are HF going to cover that?
- mrkramer 2y agoI always thought you could set your "maximum limit" for spending on cloud providing platforms.
- deusum 2y agoThat $10k was probably the limit for their work, not someone else’s stolen time.
- a1o 2y agoThat's surprisingly not a thing in many platforms.
- foolishbard 2y agoAnthropic is too new to have built that functionality I guess. Only found out because they were mad that my key was abusing their ToS and they notified the organization owner.
- internetter 2y ago> Anthropic is too new to have built that functionality I guess. That’s no sort of excuse
- Tiberium 2y agoAre you sure it was only stored in your space secrets? Not variables (which are public) or stored in the .env file (also public).
- foolishbard 2y agoI searched everywhere for any other leaks of it and found nothing.
- Liftyee 2y agoThe title made me think this was an article about space, but instead I got an article about Space.
- Mo3 2y agoI legit thought someone leaked proof of extraterrestrial life and disclosure began. Another day..
- afro88 2y ago> Over the past few days, we have made other significant improvements to the security of the Spaces infrastructure, including completely removing org tokens (resulting in increased traceability and audit capabilities), implementing key management service (KMS) for Spaces secrets, robustifying and expanding our system’s ability to identify leaked tokens and proactively invalidate them, and more generally improving our security across the board. That's a serious amount of non-trivial work to be done in "a few days". The kind of work that should trigger more time consuming activities like security audits, pen tests and the like, before going live, right?
- erhaetherth 2y agoHopefully the work was underway for awhile already, and maybe they just launched it now because the damage is already done?
- fragmede 2y agoat a larger organization with a whole SRE department that inclues a dedicated security team, sure, but (my impression is) huggingface isn't that size of an org (yet).
- nmstoker 2y agoThere's no mention of handling with regard to costs inappropriately incurred - wouldn't access to the secrets let people call APIs and run up costs? Or is this purely about theft of data/code?
- jerpint 2y agoIt could be both. In my case my keys were used to call OpenAI, almost certain they were leaked from my Spaces secrets
- jerpint 2y agoI noticed a few weeks ago that some of my OpenAI keys got compromised, they were only active as secrets on a huggingface space. I got an email a few days ago informing me that the spaces were compromised , so I suspect this issue has been going on for at least a few weeks