Top
Best
New

Posted by swyx 1 day ago

PingCap TiDB Leaks(fulcrumsec.vg)
248 points | 35 commentspage 2
esafak 23 hours ago|
https://www.moxfive.com/blog/who-is-fulcrumsec-inside-the-cl...
rvz 1 day ago||
First the Google Cloud outage [0], then the CA private key leak [1]...

...and now this...

> Today we are making the PingCAP breach public. We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers.

This is an entire leak of ALL PingCap TiDB's customers AND data.

All of this in a single day. It is over.

[0] https://news.ycombinator.com/item?id=50163961

[1] https://news.ycombinator.com/item?id=50166579

gregwebs 1 day ago||
I am reading this as a leak of every possible piece of metadata but not an actual leak of customer data. They have SQL logs which do contain customer data and there is a mention of some snapshots/imports.
berenddeboer 7 hours ago|||
they leaked full connection strings for customer databases with users and passwords.
hdjdnxjzhzhs 1 day ago|||
How the fuck is 10.6TB metadata?
gregwebs 23 hours ago|||
TiDB is for large scale data. You generally wouldn't use it unless you have at least 1TB of data. 10TB is a single small customer database for them.
fock 12 hours ago||||
(POV when storing 1PB in Oracle) when I saw the 10 TB in another post, I was like "wait, isn't this sold to scale out, we have 100 times the data here".
binsquare 1 day ago|||
Easily at scale

Size is not a good indicator for content quality

qingcharles 1 day ago||
Don't forget the PHP megabomb dropping in a few hours too.
gooseai 1 day ago||
[dead]
jedisct1 18 hours ago|
It's written in Rust, so it's safe.
boorbat 15 hours ago|
https://github.com/pingcap/tidb reports as 95% Go with no Rust at all?
squirrellous 15 hours ago||
That confused me too since I remember reading they are Rust proponents. Apparently their storage engine TiKV is written in Rust, and TiDB is the database built on top.
bbkane 25 minutes ago||
https://github.com/tikv/tikv