Comment by cmiles8
4 hours ago
Correct. Basic security practices would have stopped most of this. Thus what is most insightful here is less that the attack was sophisticated but more that Hugging Face was running a setup that, by standards that are the norm elsewhere, would appear amateurish.
You might be able to say that HF made some amateurish mistakes, but this attack certainly was fairly sophisticated. It relied a number of separate exploits or vulnerabilities that it combined and used over the course of multiple days. Calling it otherwise seems to be downplaying it.