To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

TBH I would be less against the cameras if they were open to everyone, so anyone could track anyone (equal footing, good for goose good for gander). Figure this would be so anathema to LE et al that it would be quickly shot down

Well, technically, we're letting Natalie do it, which is, of course, worse in every way imaginable, since she's immune to the sense of embarrassment that sometimes restrains him from acting on every little whim.

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

I believe the plan was to give that sobriquet to Lake Michigan, in honour of its decidedly flaccid silhouette.

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.

I agree on the apps thing.... if I can do it from my desktop and a browser, I should be able to do the same from my phone and a browser. Apps should do things that the browser can't/shouldn't be allowed to do (interacting with other hardware, local storage, etc)

I won bar bets at a conference when the Respondus Lockdown Browser was first released and touted... all you had to do was change the user agent string in whatever browser you wanted to use.

Our nursing faculty really wanted it, I kept saying no because it took me mere moments to bypass and it would've added a ton of complexity to our computer lab environments, etc. They said "well, our students aren't like you, they are nurses not geeks", then I pointed out that they had 140-150 18-21 year old females, and our IT track department was the next building over and full of 18-21 year old males and if they doubted the two groups would intermix they could pull out the pics of the graduating class from 5 years prior and I could point out my then-girlfriend-now-wife, and all it would take is one for the word to get out and any pretense of security would evaporate.

As a sysadmin who could in theory lookup the admin passwords for our colleges police department, I have to do annual policy and cyber security training on accessing the NCJIS data, both the typical cyber security stuff and what that data is allowed to be accessed for. Just did my training last week, and non-appropriate access is a crime - this is not "the officer arrested the guy because he didn't know the law" stuff, this is "the officer violated the law" stuff.

how many jobs are out there that require a degree in Gender Studies specifically (as opposed to "any 4 year degree" types)

When I make things in rust, the earlier modules just work. Later modules don't turn into accidental integration tests for the first modules. Obviously, I could screw up some business logic, but even that seems to be rare with rust, as I am spending way less time wondering why this or that threading bug can't be replicated, and can focus on the business logic, not the tool.

The only things they will do is: Clear some land, put up some signs, have some architects (or just AI) do up some plans, do a ribbon cutting/first shovel ceremony, and then wait out the trump admin.

I regret to inform you that you have woefully underestimated it. The actual retail rate offered to consumers is closer to $2200 US per gallon. Sources: internet-ink.com, cbc.ca. This $14 million fine is only worth like, seven thousand gallons, or less than 200 oil barrels of ink.

Simply eliminate recommendation systems. All of them; social media, news, shopping, the lot.

This kills doom scrolling, this kills these weird echo chambers where people look up a topic, and end up in a doom feedback loop most cults would be proud of.

If you don't search for it, you don't see it. Full stop.

This would pretty much break the back of the US tech firms in many areas.

I read an article from long ago in the very earliest days of youtube where they came up with a simple new recommendation system and it increased the chances of someone watching another video by something like 17,000%.

That was a simple one to drive traffic. But now, it is getting far more insidious. If you are a man looking at comments on a he said she said relationship video, you will generally see comments supporting the man's side. If you are a woman, you will see comments supporting the woman's side.

Just kill this sort of algorithmic behavior.

These dark patterns are nasty. If you go to that big shopping site, and look up something like, "replacement battery for pixel 7 pro", you will get a screen mostly of the correct item. If you sort by price (the last thing they want you to do) you will get a screen full of spatulas, insoles, and things which they very much know you are not looking for. They want to train you to not sort by price.

These algorithms are toxic to human society. They are a huge reason we are seeing such insane polarization in things like politics, but also why you have people feeling marginalized and attacked, when it is just influencers telling them that this is the case. I live in a place where certain very tiny group rights are not very well respected. I had a member of this group telling me they are going to leave before the government kills them. WTF? While my local government doesn't particularly like them, it isn't sending out death squads. Not only is their mental health more threatened by this sort of social media crap, than by the behavior of the government, the government itself is responding to people who are doom looped into hating this particular group.

This sort of crap is poison all over the world. Under 16 bans and other crap is a tiny step, but the reality is that if the poison is there, it is still bad, and teens will still end up accessing it in droves. If the poison is removed, the age ban largely becomes moot.

By your powers combined, I am... the British Colonies!