To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

That was about their opinion shows, not their news shows. That case was specifically about Tucker Carlson.

Those kinds of arguments weren't saving Fox from the Dominion lawsuit, though. If they seemed like to have worked, Fox wouldn't have settled for almost $800 million right before trial.

Hastert doesn't have a law named after him. There's the Hastert Rule, which is an informal rule that no bill should be brought before the House to vote on it unless it already has the support of the majority of the majority party.

Hastert was convicted of structuring withdrawals to avoid reporting requirements and making false statements. The charges themselves were not inherently about homosexuality, though it came about from him covering up his same-sex abuse of a minor, and the indictment didn't mention the sexual abuse, and his allocution under the plea deal didn't initially mention it. He did admit it under pressure from the judge, who seemed to start to lean against accepting his plea without him admitting to the molestation, for which he could not be charged because the statute of limitations had expired decades prior.

Hastert has never come out as gay. Most child molesters, even those who molest the same sex, never identify as homosexual.

Number 7 according to Car & Driver, which I think is much more trustworthy than whatever "Wealthy Driver" is. The Car & Driver list is also applies to 2025 rather than 2023.

https://www.caranddriver.com/n...

Well, technically, we're letting Natalie do it, which is, of course, worse in every way imaginable, since she's immune to the sense of embarrassment that sometimes restrains him from acting on every little whim.

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

I believe the plan was to give that sobriquet to Lake Michigan, in honour of its decidedly flaccid silhouette.

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.

It's not a remotely level playing field. One soldier who took part in the Venezuela raid basically had orders in hand when he placed multiple bets on the timing of the raid, netting a ton of money. There have been many other examples of inside information being used to stack the odds.

This is absolutely not true. There are plenty of people in the financial side of a business that have information that is material but non-public, and trading based on that knowledge is illegal, including sudden cuts in spending, audit results prior to publication, and more. HR will be aware of major layoffs. Facilities might be aware of impending site closures before they're announced. All these things can be used for insider trading.

Lower-level people aren't usually pursued because they're small enough to fly under the radar. But that doesn't mean it's not illegal, and it doesn't mean it never happens.

They already have a planned rotation. There will be two crews, rotating every four hours. This isn't unlike existing long-haul flights, except that instead of the crews rotating at the same time, they will be on two-hour offsets. One pilot will stay for the first four hours, the other for the first two hours. A replacement will swap in at two hours and stay through the sixth hour, and then the other will swap at four hours and stay through the eighth hour, and so on. Qantas said that this will apply to all flights of 20 hours or more.

Most comms software is better handled by a service. Email, chat, phone, etc. Let someone else deal with the problems of maintaining it. Almost everything else is worth discussing.

Potentially, but not necessarily more than they're going to spend on the work.

Maybe Apple sees it as just the right thing to do. Apple has access to enormous volumes of data that they could monetize if they wanted, but they don't. They jumped through a bunch of hoops to make Lockdown Mode that, if the user screws it up, means that everything is lost. They are unlikely to be making money on that, especially since it limits some app installations and functionality, and they're not going to get fined by anyone for not having it. There is, in fact, a real risk that someone is going to fine them for being unable to recover the data.

It holds a legal and fiduciary duty to act in the best interests of its shareholders. Tim Cook rather famously told off an Apple shareholder who asked him to commit to pursuing only programs that would be profitable, saying, "When we work on making our devices accessible by the blind, I don't consider the bloody ROI."

That's just one small example by a powerful CEO after a shareholder initiative was shot down 98-2, but most companies spend money on things that reduce profits or are not profitable. Look at the sprawling HQs with fancy buildings that are set up by so many companies when they could have gone with simple brutalist architecture. There are companies that pay well because it promotes long-term stability even at the expense of short-term profits.

I get that these big companies don't deserve blind trust, but understanding what their obligations are is much more helpful than oversimplifications.

I regret to inform you that you have woefully underestimated it. The actual retail rate offered to consumers is closer to $2200 US per gallon. Sources: internet-ink.com, cbc.ca. This $14 million fine is only worth like, seven thousand gallons, or less than 200 oil barrels of ink.