4 ms·

Does anyone want to talk about the hack itself? Can anyone give more details than "left their database open"? I came to this site hoping for a real discussion a

Does anyone want to talk about the hack itself? Can anyone give more details than "left their database open"? I came to this site hoping for a real discussion about that and didn't see it here yet...

a012 2y ago
My bet is on SQL injection
- shaunpud 2y ago
  [flagged]
- rozap 2y ago
  In the year of our lord 2025? I doubt it. I'd put money on "some third party cloud service was configured in a silly way". But, I would love to see details.
- radicalbyte 2y ago
  They used one of those databases which are easy to connect directly to the internet, it's the same thing as about 90% of modern data breaches. Every generation we make things much easier, lower the bar, and are rewarded when amateurs make amateur mistakes like this.
  - bregma 2y ago
    We made it so easy to program that any idiot could do it. So they do.
    - radicalbyte 2y ago
      I found my new signature quote.
  - koakuma-chan 2y ago
    No way this is real.
rsynnott 2y ago
> The database it is pulling from can be and has been written to by third parties, and will show up on the live website. Not enough detail to say for sure; could be SQL injection, could be credentials exposed in the frontend.
- seba_dos1 2y ago
  ...or endpoints not requiring any credentials at all.
  - rsynnott 2y ago
    … Oh, yes. After reading more carefully I see it, er, IS that. Where the hell did Musk find these people? 1996?
    - CharlesChadwick 2y ago
      I'm not too sure about this theory; just went on the DOGE site and the API endpoints don't allow for POST requests, and I can't find anything that allows me to upload
internetter 2y ago
According to a source of mine, there were unsecured API endpoints for modification
monocasa 2y ago
Someone unminified the js, and it turned out that a bunch of the rest endpoints it knew about were just unverified crud endpoints for the site. https://archive.ph/2025.02.14-132833/https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/ https://archive.ph/2025.02.14-132833/https://www.404media.co...
- Euphorbium 2y ago
  Smells exactly like llm created solution.
  - monocasa 2y ago
    Or just what happens when you hire a bunch of 20 year olds and let them loose. That's currently how I model my usage of LLMs in code. A smart veeeery junior engineer that needs to be kept on a veeeeery short leash.
    - ellisv 2y ago
      Yes. LLMs are very much like a smart intern you hired with no real experience who is very eager to please you.
      - heavyset_go 2y ago
        IMO, they're worse than that. You can teach an intern things, correct their mistakes, help them become better and your investment will lead to them performing better. LLMs are an eternal intern that can only repeat what it's gleaned from some articles it skimmed last year or whatever. If your expected response isn't in its corpus, or isn't in it frequently enough, and it can't just regurgitate an amalgamation of the top N articles you'd find on Google anyway, tough luck.
        worik 2y ago
        The Age of the Eternal Intern
guywithahat 2y ago
I mean the article is paywalled but it sounds like this is isolated to their site-displayed twitter feed; basically the site was hosted by cloudflare and you could insert your own fake tweets into what was recorded on the site (but not on the actual DOGE twitter feed). I don't think any data was actually compromised
- ProjectArcturis 2y ago
  Yeah, it's just tremendously embarrassing. These are supposed to be the tech geniuses who can parse 50 years of accumulated legacy code and find all the government waste? In 3 weeks?
  - ghthor 2y ago
    Data science and websites are different beasts.
    - throwway120385 2y ago
      Some of the "data science" people I've met certainly believed that they could architect entire software systems just because they understood how to structure data in databases.
    - ProjectArcturis 2y ago
      Surely technical competence is strongly correlated across the two beasts.
    - gregw2 2y ago
      I'm not yet sure whether they are even doing data science. Anecdote time (pinch of salt required): A relative of mine studying accounting went to the Doge site to see the "audit" and "analytics" records that some acquaintance arguing with her said "see the doge site!" for the proof. What she found when visiting the site was no "audit" at all, but instead a word count of how often objectional terms appear in legislation or government sites. (DEI? Trans? LGBTQ?). Being in the analytics/data engineering space myself, I was pretty amused to hear that was the quality of "analytics" being done. Wasn't "word count" the "hello world" example for Hadoop big data back in 2013?

Does anyone want to talk about the hack itself? Can anyone give more details than "left their database open"? I came to this site hoping for a real discussion about that and didn't see it here yet...

a012 2y ago

My bet is on SQL injection

shaunpud 2y ago
[flagged]
rozap 2y ago
In the year of our lord 2025? I doubt it. I'd put money on "some third party cloud service was configured in a silly way". But, I would love to see details.
radicalbyte 2y ago
They used one of those databases which are easy to connect directly to the internet, it's the same thing as about 90% of modern data breaches. Every generation we make things much easier, lower the bar, and are rewarded when amateurs make amateur mistakes like this.
- bregma 2y ago
  We made it so easy to program that any idiot could do it. So they do.
  - radicalbyte 2y ago
    I found my new signature quote.
- koakuma-chan 2y ago
  No way this is real.

rsynnott 2y ago

> The database it is pulling from can be and has been written to by third parties, and will show up on the live website. Not enough detail to say for sure; could be SQL injection, could be credentials exposed in the frontend.

seba_dos1 2y ago
...or endpoints not requiring any credentials at all.
- rsynnott 2y ago
  … Oh, yes. After reading more carefully I see it, er, IS that. Where the hell did Musk find these people? 1996?
  - CharlesChadwick 2y ago
    I'm not too sure about this theory; just went on the DOGE site and the API endpoints don't allow for POST requests, and I can't find anything that allows me to upload

internetter 2y ago

According to a source of mine, there were unsecured API endpoints for modification

monocasa 2y ago

Someone unminified the js, and it turned out that a bunch of the rest endpoints it knew about were just unverified crud endpoints for the site. https://archive.ph/2025.02.14-132833/https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/ https://archive.ph/2025.02.14-132833/https://www.404media.co...

Euphorbium 2y ago
Smells exactly like llm created solution.
- monocasa 2y ago
  Or just what happens when you hire a bunch of 20 year olds and let them loose. That's currently how I model my usage of LLMs in code. A smart veeeery junior engineer that needs to be kept on a veeeeery short leash.
  - ellisv 2y ago
    Yes. LLMs are very much like a smart intern you hired with no real experience who is very eager to please you.
    - heavyset_go 2y ago
      IMO, they're worse than that. You can teach an intern things, correct their mistakes, help them become better and your investment will lead to them performing better. LLMs are an eternal intern that can only repeat what it's gleaned from some articles it skimmed last year or whatever. If your expected response isn't in its corpus, or isn't in it frequently enough, and it can't just regurgitate an amalgamation of the top N articles you'd find on Google anyway, tough luck.
      - worik 2y ago
        The Age of the Eternal Intern

guywithahat 2y ago

I mean the article is paywalled but it sounds like this is isolated to their site-displayed twitter feed; basically the site was hosted by cloudflare and you could insert your own fake tweets into what was recorded on the site (but not on the actual DOGE twitter feed). I don't think any data was actually compromised

ProjectArcturis 2y ago
Yeah, it's just tremendously embarrassing. These are supposed to be the tech geniuses who can parse 50 years of accumulated legacy code and find all the government waste? In 3 weeks?
- ghthor 2y ago
  Data science and websites are different beasts.
  - throwway120385 2y ago
    Some of the "data science" people I've met certainly believed that they could architect entire software systems just because they understood how to structure data in databases.
  - ProjectArcturis 2y ago
    Surely technical competence is strongly correlated across the two beasts.
  - gregw2 2y ago
    I'm not yet sure whether they are even doing data science. Anecdote time (pinch of salt required): A relative of mine studying accounting went to the Doge site to see the "audit" and "analytics" records that some acquaintance arguing with her said "see the doge site!" for the proof. What she found when visiting the site was no "audit" at all, but instead a word count of how often objectional terms appear in legislation or government sites. (DEI? Trans? LGBTQ?). Being in the analytics/data engineering space myself, I was pretty amused to hear that was the quality of "analytics" being done. Wasn't "word count" the "hello world" example for Hadoop big data back in 2013?