4 ms·

So much effort in trying to tarnish DeepSeek the last 24hrs

by nico 2y ago

deleted 2y ago
[deleted]
mandmandam 2y ago
Yep. Kinda like how your comment was grey within 1 minute, despite stating an objective truth. Sure, this is to be expected given the billions and billions of dollars at stake but like - that money is gone lol. DeepSeek isn't going back in the bottle, nor is open source AI in general.
- IncreasePosts 2y ago
  The comment isn't wrong, but the implication is at deep seek is somehow special and is getting undue attention from hackers. Any app that skyrockets from nowhere to number one in the app store overnight will have the attention of probably hundreds of thousands of hackers.
  - mandmandam 2y ago
    > the implication is at deep seek is somehow special and is getting undue attention from hackers ... It is special. There was over a trillion dollars wiped from tech stocks lol, in a massive win for consumers and the planet. You can't say this is like Flappy Bird or something.
    - IncreasePosts 2y ago
      The stock market does all sorts of silly things. If the stocks recover in 2 weeks to where they were, will that be deep seek erasing $1T and tech re-earning $1T? Or deep seek doing nothing?
      - codr7 2y ago
        The damage was done, if it was 100% based on truth or how fast they recover has nothing to do with it.
      - mandmandam 2y ago
        > The stock market does all sorts of silly things. For sure. This one was pretty clear though. It's exactly what you'd expect when a moat evaporates overnight. Even if tech stocks recover in 2 weeks (doubt) an open source model comparable to o1 with a 50x efficiency gain is still not just another app. Which means there will be bad actors with a special interest in spreading narratives on every relevant forum...
        rnd0 2y ago
        >Which means there will be bad actors with a special interest in spreading narratives on every relevant forum Which brings us neatly to OpenAI
sho_hn 2y ago
Can't fault hackers for taking a look at a website that goes from "virtually unknown" to "extremely popular and headline news globally" practically over night. If nothing else, the probability of low-hanging fruit in something that is barely battle-tested is high. You can fault them for disclosure practices though :-)
- htrp 2y ago
  > Wiz Research has identified a publicly accessible ClickHouse database belonging to DeepSeek, which allows full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information. >The Wiz Research team immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure. It seems like Wiz told deepseek and deepseek secured this vuln?
xmprt 2y ago
I, for one, think this is a valuable piece of information and somewhat interesting analysis. You can take the cynical point of view that this was released just to tarnish their reputation or you can assume that it's security researchers publishing an important discovery just like they've always done whether it's for OpenAI, Microsoft Copilot, or any other AI or non AI product.
- nyclounge 2y ago
  >https://news.ycombinator.com/item?id=42871371#42872454 https://news.ycombinator.com/item?id=42871371#42872454 We all agree this kind of leak should be disclosed. However normally security researchers don't just leaks specific URL and etc. This may be what the parent is referring to.
- kdmtctl 2y ago
  I think that was a shameless self promotion. A lot of PR and free traffic by taking a low hanging fruit. Nothing else. But they did some good though.
gruez 2y ago
I'm not sure why you think why this discovery has to be some sort of "effort in trying to tarnish DeepSeek". Deepseek is the #1 downloaded app and and the media can't stop talking about it. That means a lot more people are looking into the app and possibly finding vulnerabilities, no conspiracy needed.
- skupig 2y ago
  edit: snip, misinfo, I'm illiterate. Sorry!
  - skywhopper 2y ago
    What are you talking about? They did follow responsible disclosure.
    - immibis 2y ago
      No idea why this is downvoted. Responsible disclosure normally means you wait up to 90 days so they can fix it, before you disclose it to the public. In this case, it was fixed immediately, so they disclosed it to the public immediately. Which is another thing it seems Chinese corporations do better than American ones.
  - ZeWaka 2y ago
    > instead of following responsible disclosure practices They literally did, though? They were resolved before publishing.
- talldayo 2y ago
  Not to mention the same thing happened to OpenAI and basically the same effort went into shaming them: https://www.theverge.com/2024/7/3/24191636/openai-chatgpt-mac-app-conversations-plain-text https://www.theverge.com/2024/7/3/24191636/openai-chatgpt-ma...
khazhoux 2y ago
Are you saying this report was falsified, or that the press should keep things like this secret?
- LarsKrimi 2y ago
  Probably they are rather suggesting that there are a lot of unscrupulous western companies with a lot to lose who might have an interest in convincing certain people to skip responsible disclosure
  - khazhoux 2y ago
    The vulnerability was fixed before the disclosure, so that's a non-issue here.
- rnd0 2y ago
  It would be very nice if the press didn't just fall over itself trying to be a free PR agency for OpenAI.
zhengiszen 2y ago
you're absolute right, so much garbage propaganda in many languages. For Apple we have tv news that usually promotes new Apple or OpenAI products (wtf!!) that are trying to tarnish DeepSeek on the privacy level... No words about all those garbage software siphoning off the web (without respecting neither copyright nor privacy)
blackeyeblitzar 2y ago
[flagged]
- kranner 2y ago
  I don't know about 1-4 and 5 seems an honest mistake. Is there a source for the misleading GPU count? Dario cites Dylan Patel, and pt 4 cites Alexander Wang, but these are just claims so far. As far as censorship regarding Chinese history, does it matter? The other models have other areas that are censored. Is anyone planning to use LLMs to look up historical facts anyway? Stealing IP? That's rich coming from AI companies that mined the entire public internet. Did they get permissions from copyright holders in every instance? And if DeepSeek did evade particular US sanctions whose only justification seems to be to prop up US's economic hegemony over the rest of the world (unlike sanctions against weapons, invasions and human rights violations), then good for them.
krick 2y ago
Maybe, but having dev services outside of VPN is pretty nuts, not much effort needed to find that. Wouldn't expect a company with such budgets be that careless, I'm sure it's only the tip of the iceberg.
- meiraleal 2y ago
  One more proof that AGI is not near
deleted 2y ago
[deleted]
lysace 2y ago
It would be incredibly immature and naive to presume that the data fed to this service is not going to be data mined by the CCP. Downvoted - because of course the CCP wouldn't want all of this data, that's preposterous. What would they even do with it? /S
deleted 2y ago
[deleted]
breakitmakeit 2y ago
Elsewhere perhaps, this seems like a pretty standard/legit security flaw in a new application which is found and hopefully quickly closed. If your information is sensitive, do not use an LLM by public API - absolutely all of your data is being stored and processed. For all of them.

So much effort in trying to tarnish DeepSeek the last 24hrs

by nico 2y ago

So much effort in trying to tarnish DeepSeek the last 24hrs

deleted 2y ago

[deleted]

mandmandam 2y ago

Yep. Kinda like how your comment was grey within 1 minute, despite stating an objective truth. Sure, this is to be expected given the billions and billions of dollars at stake but like - that money is gone lol. DeepSeek isn't going back in the bottle, nor is open source AI in general.

IncreasePosts 2y ago
The comment isn't wrong, but the implication is at deep seek is somehow special and is getting undue attention from hackers. Any app that skyrockets from nowhere to number one in the app store overnight will have the attention of probably hundreds of thousands of hackers.
- mandmandam 2y ago
  > the implication is at deep seek is somehow special and is getting undue attention from hackers ... It is special. There was over a trillion dollars wiped from tech stocks lol, in a massive win for consumers and the planet. You can't say this is like Flappy Bird or something.
  - IncreasePosts 2y ago
    The stock market does all sorts of silly things. If the stocks recover in 2 weeks to where they were, will that be deep seek erasing $1T and tech re-earning $1T? Or deep seek doing nothing?
    - codr7 2y ago
      The damage was done, if it was 100% based on truth or how fast they recover has nothing to do with it.
    - mandmandam 2y ago
      > The stock market does all sorts of silly things. For sure. This one was pretty clear though. It's exactly what you'd expect when a moat evaporates overnight. Even if tech stocks recover in 2 weeks (doubt) an open source model comparable to o1 with a 50x efficiency gain is still not just another app. Which means there will be bad actors with a special interest in spreading narratives on every relevant forum...
      - rnd0 2y ago
        >Which means there will be bad actors with a special interest in spreading narratives on every relevant forum Which brings us neatly to OpenAI

sho_hn 2y ago

Can't fault hackers for taking a look at a website that goes from "virtually unknown" to "extremely popular and headline news globally" practically over night. If nothing else, the probability of low-hanging fruit in something that is barely battle-tested is high. You can fault them for disclosure practices though :-)

htrp 2y ago
> Wiz Research has identified a publicly accessible ClickHouse database belonging to DeepSeek, which allows full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information. >The Wiz Research team immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure. It seems like Wiz told deepseek and deepseek secured this vuln?

xmprt 2y ago

I, for one, think this is a valuable piece of information and somewhat interesting analysis. You can take the cynical point of view that this was released just to tarnish their reputation or you can assume that it's security researchers publishing an important discovery just like they've always done whether it's for OpenAI, Microsoft Copilot, or any other AI or non AI product.

nyclounge 2y ago
>https://news.ycombinator.com/item?id=42871371#42872454 https://news.ycombinator.com/item?id=42871371#42872454 We all agree this kind of leak should be disclosed. However normally security researchers don't just leaks specific URL and etc. This may be what the parent is referring to.
kdmtctl 2y ago
I think that was a shameless self promotion. A lot of PR and free traffic by taking a low hanging fruit. Nothing else. But they did some good though.

gruez 2y ago

I'm not sure why you think why this discovery has to be some sort of "effort in trying to tarnish DeepSeek". Deepseek is the #1 downloaded app and and the media can't stop talking about it. That means a lot more people are looking into the app and possibly finding vulnerabilities, no conspiracy needed.

skupig 2y ago
edit: snip, misinfo, I'm illiterate. Sorry!
- skywhopper 2y ago
  What are you talking about? They did follow responsible disclosure.
  - immibis 2y ago
    No idea why this is downvoted. Responsible disclosure normally means you wait up to 90 days so they can fix it, before you disclose it to the public. In this case, it was fixed immediately, so they disclosed it to the public immediately. Which is another thing it seems Chinese corporations do better than American ones.
- ZeWaka 2y ago
  > instead of following responsible disclosure practices They literally did, though? They were resolved before publishing.
talldayo 2y ago
Not to mention the same thing happened to OpenAI and basically the same effort went into shaming them: https://www.theverge.com/2024/7/3/24191636/openai-chatgpt-mac-app-conversations-plain-text https://www.theverge.com/2024/7/3/24191636/openai-chatgpt-ma...

khazhoux 2y ago

Are you saying this report was falsified, or that the press should keep things like this secret?

LarsKrimi 2y ago
Probably they are rather suggesting that there are a lot of unscrupulous western companies with a lot to lose who might have an interest in convincing certain people to skip responsible disclosure
- khazhoux 2y ago
  The vulnerability was fixed before the disclosure, so that's a non-issue here.
rnd0 2y ago
It would be very nice if the press didn't just fall over itself trying to be a free PR agency for OpenAI.

zhengiszen 2y ago

you're absolute right, so much garbage propaganda in many languages. For Apple we have tv news that usually promotes new Apple or OpenAI products (wtf!!) that are trying to tarnish DeepSeek on the privacy level... No words about all those garbage software siphoning off the web (without respecting neither copyright nor privacy)

blackeyeblitzar 2y ago

[flagged]

kranner 2y ago
I don't know about 1-4 and 5 seems an honest mistake. Is there a source for the misleading GPU count? Dario cites Dylan Patel, and pt 4 cites Alexander Wang, but these are just claims so far. As far as censorship regarding Chinese history, does it matter? The other models have other areas that are censored. Is anyone planning to use LLMs to look up historical facts anyway? Stealing IP? That's rich coming from AI companies that mined the entire public internet. Did they get permissions from copyright holders in every instance? And if DeepSeek did evade particular US sanctions whose only justification seems to be to prop up US's economic hegemony over the rest of the world (unlike sanctions against weapons, invasions and human rights violations), then good for them.

krick 2y ago

Maybe, but having dev services outside of VPN is pretty nuts, not much effort needed to find that. Wouldn't expect a company with such budgets be that careless, I'm sure it's only the tip of the iceberg.

meiraleal 2y ago
One more proof that AGI is not near

deleted 2y ago

[deleted]

lysace 2y ago

It would be incredibly immature and naive to presume that the data fed to this service is not going to be data mined by the CCP. Downvoted - because of course the CCP wouldn't want all of this data, that's preposterous. What would they even do with it? /S

deleted 2y ago

[deleted]

breakitmakeit 2y ago

Elsewhere perhaps, this seems like a pretty standard/legit security flaw in a new application which is found and hopefully quickly closed. If your information is sensitive, do not use an LLM by public API - absolutely all of your data is being stored and processed. For all of them.