To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

Well, technically, we're letting Natalie do it, which is, of course, worse in every way imaginable, since she's immune to the sense of embarrassment that sometimes restrains him from acting on every little whim.

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

I believe the plan was to give that sobriquet to Lake Michigan, in honour of its decidedly flaccid silhouette.

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.

lol don't worry. I feel the same about your house heating.

You will not die inside your house from not having heating. People survived for millennia without natural gas furnaces. Turn your furnace off! Just put on more clothes!

"built to contain heat". sigh. I'm not going into a thermodynamics discussion. Seems like europeans can't grasp the concept that insulation works both ways.

Anyways, get an AC for the living room and use a fan to push the cool air into your bedroom at night. Yes, it's not ideal. But sleeping on 40C is worse.

And also something something "60 kg AC". yeah, you're doing it wrong. I just checked and my 7000W Daikin is less than 30kg for the heavy part (the outdoor unit).

As for the install, I got tired of idiots here doing terrible jobs. I just bought all of the tools and nowadays I install and service my own air conditioners and have zero regrets. And no, you don't need any license to do this: the refrigerant is inside the outdoor unit from the factory, so at least for the initial install (and for the next 10 years if you do it right) you will not need any refrigerant.

You tried to be snarky and all you said was the exact same thing I did, just more verbosely.

Do you do that in the winter too? 10C with a couple of sweaters is quite a pleasant temperature too...

This is my favorite response to these idiots. If you don't need air conditioning, then you don't need heating either. They talk about how amazing their houses are in the winter because they "retain heat" and whatever bullshit, but they actively heat it.

Turn the heating off, or shut the fuck up about AC.

Enjoy dying.

I dont know man, I live in Argentina and my "tiny split unit", 3500W, is more than capable of keeping my bedroom cool.

Even my "large" 7000W unit for the shop was so big that ... i had to help a friend to help me lift it to the wall brackets. It's bolted to the brick wall with 4 10mm bolts.

Those "tiny split units" do just fine in Japan where they have even less space than you do.

Sounds to me you're just making excuses and, somehow, trying to blame "the americans"

I do not understand why Americans try to push AC so hard.

Imagine choosing death instead of accepting an american is right.

Germany is on the same latitude as as newfoundland idiot. 37C is NOT normal.

That's not how climate works. Madrid is at the same latitude as New York City and New York has blizzards and regular snow. Madrid doesn't.

I regret to inform you that you have woefully underestimated it. The actual retail rate offered to consumers is closer to $2200 US per gallon. Sources: internet-ink.com, cbc.ca. This $14 million fine is only worth like, seven thousand gallons, or less than 200 oil barrels of ink.

The problem is that we were on the Team plan which is a flat rate plan.

You raise a valid point but it has no substance. Management confronted us and said "you are doing it wrong!" And I stopped them "no, we aren't. even if we are, we can try to economize on tokens. We can get a 100% improvement, 200%? 500%?

It's still order of magnitude LESS than what we were doing and it's costing us, in dollars, twice what we were paying before.

You see, the problem with the Enterprise plan is that, unlike Team or Pro, it does not include any (subsidized) usage. Every token counts towards the budget. And corporate either did not read the fine print, or they had more than 150 developers (the maximum allowed by Team plan) and they were forced to switch.