The most unprecedented exercise in investor gullibility... So far. This award could have been given out annually for a few years now. Who will be the contender next year.

I do my Elvis impersonations in private, so no one will ever know.

Until the 18th Century there was no such thing as "posted prices", unless prices were set by government regulation (only certain staples, and rarely). Instead you always had to dicker with the seller to arrive at what you would pay.

In the mid 1700s Quakers in Pennsylvania decided they did not like dickering since it meant both parties were trying to deceive the other to their best advantage. It also meant bad will if person A found out he paid more than person B for the same goods. To eliminate this troubling daily moral dilemma they introduced the startling new idea of offering goods at fixed prices that were posted for all to see.

Oh, how not 21st Century can you get? The idea of prices being fair and equitable, and honestly posted for everyone! How quaint! Our corporate masters have decide that we all techno-rubes to be fleeced as efficiently as data harvesting and AI can make it!

So just to be clear here, are you saying that if I follow a person around as he goes about his day in the public sphere, then I am "actively stalking and harassing" and that is not to be allowed, but that if I set up an array of cameras which films that person as he goes about his day in the public sphere, then I am "passively filming" and that is entirely okay?

"You do realize journalists have no rights beyond what a normal citizen has?"

Likewise, you do realize that Flock and Axon have no rights beyond what normal citizens have?

To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

If dark matter interacted with itself, you would expect to see its distribution change as the collisions cause it to clump together. Those clumps would tend to gather a bit inwards towards the core and you'd expect a distribution similar to that of visible matter (I.e. the stars, which underwent exactly that colliding and clumping process when the galaxy formed). We don't observe that: instead dark matter seems to form diffuse halos in galaxies, as you'd expect from something that interacts very weakly (or not at all). That said, some theories of dark matter do allow for stronger self-interactions, possibly creating an entire dark sector of physics invisible to normal matter. But those models tend to be considered more niche possibilities.

Well, technically, we're letting Natalie do it, which is, of course, worse in every way imaginable, since she's immune to the sense of embarrassment that sometimes restrains him from acting on every little whim.

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

I believe the plan was to give that sobriquet to Lake Michigan, in honour of its decidedly flaccid silhouette.

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.

https://www.cs.wisc.edu/2025/0...

And DARPA has a whole program for it:

https://www.darpa.mil/research...

I live along the Colorado Front Range. The Goodyear blimps don't fly here because of the elevation (reduces lift) and number of wind events with gusts to 60 mph. I will be curious to see if drone delivery is practical.

Nadella is not showing psychosis here, but the fact that he thinks his chatbot hack of a webpage is evidence of something important show him on the road to get there.

Yes, you can. If you want full physical separation, it gets pricey. Back in late 1960s, early 1970s, the Bell System did it for their switches. They were a regulated monopoly, so they earned 12% on whatever money they spent on network infrastructure. So far as I know, no private company has done the full separation thing since.

We can always hope that the pigs who fucked-up with the user names will be skinned alive, but of course, we all know this will never happen because pigs enjoy an inordinate amount of immunity totally unwarranted by their well-below average intelligence.