Your comment is pants.

Surely you know that's an absurdly dismissive opinion? North Korea has the capacity to gain access to anything anyone else does, especially if it comes from China.

To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

It's not.

Nothing will change until lots of people die (not just from the effects of such, but also things like "the boomer generation fuck off"), and/or the billionaires get hit in the wallet.

Same old story.

As someone who just had FTTP (yep, to the premises) installed in their rural home, the way they did it was thus:

- They went to the local cabinet (which is already fibre-backed to the local exchange many km's away), strung a fibre out of it.
- They got up the telegraph pole in my streets, strung a new fibre off it.
- They used the old copper line that's been there since the 60's to slide the new fibre reel down.
- They put a second hook on my eaves, and hooked the fibre from there, and then wired the fibre direct into my house.
- They didn't remove a damn thing.

Took about 20 minutes, judging by the CCTV.

It would take about the same time just to pull down the copper from my house safely (the above did not require closing or working in the road, for instance), then isolating that from the dozens of others in the road on the pole, then removing that all the way back to the cabinet. Which I know goes underground because when I first moved in a few years ago, the BT guy had to remove that cable from, basically, a huge puddle which was cutting my DSL speed from 75Mbps to 20Mbps (DSL is amazing, though, that it still worked!).

Until everything's fibre, you can't remove those old lines, it's just not practical. And then are you really going to mobilise a bunch of people to remove a small run of copper from every street?

I once did some maths and the IT at the school I work in has something like tens of thousands of km+ of copper wiring that's unused. One room can have 30+ runs of nearly-100m. That's 3km for one room, from where a building was previously wired to have an IT suite, but then changed purpose, etc. We could, in theory, take that pure-copper cable out and recycle it. That one school likely has more copper in it than my entire village.

The fact is that it's just not worth the effort. There are huge thick bundles of it, and while it wouldn't take that long to pull it all out (much easier than putting it in because you can largely just cut and pull the entire bundle), it's not worth doing so in terms of the cost of the raw copper. We know that because honestly much of the time, rather than re-use the old copper runs which we know to be Cat5e, we just run a new Cat6a run alongside them if we do need to wire something. And Cat5e has far more metal in it than old telephone line.

I cut something like 200 cables this summer alone. And I mean I cut the last 2 metres of them because they were in my way in the cabinets. The actual RUN of cable is still in the walls and going all over the building, 50, 60, 70m runs all over the place.

I bet that a single office or school demolition recovers more copper (and steel and other stuff) than an entire village of old telephone lines, and while it may be a factor on the demolition companies finances, it's not a huge one. Scrap metal, which you have to de-sheath, transport, etc. isn't as valuable as people make out. It's why nobody arranges a regular scrap-metal collection at my local council to come and just grab anything of value that they could. No. They do that for paper. They don't do it for metal unless you arrange it with them. There's not much money in it. The only people making money are the guys lobbing some bits of lead, steel and alumium on the back of their van until they have enough to get a couple-of-hundred-quid free personal backhander as part of their work when it's all been moved at the expense of their company's fuel expense account.

Yeah, all you need is 200 years for them to book enough appointments to actually pull the stuff down, and you're golden! (or at least, copper-coloured).

Like an online bookseller turning into a global retail warehouse then renting out their datacenter services, producing talking home assistants, and launching rockets into space?

Well, technically, we're letting Natalie do it, which is, of course, worse in every way imaginable, since she's immune to the sense of embarrassment that sometimes restrains him from acting on every little whim.

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

As a Californian, I definitely would NOT have voted for this had I been given the opportunity.

And yeah, we LITERALLY have campaign ads running now to the extent of, "Pedophile murderers are being released to the streets ... and Candidate X voted for it THREE TIMES!!!!"

I believe the plan was to give that sobriquet to Lake Michigan, in honour of its decidedly flaccid silhouette.

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.

That one was yet another case of Ridley having a script, deciding it was good enough to start building sets and working on effects, and then constantly changing the script all the way up through editing. Whole subplots got dropped, characters who appeared in promo material just never showed up in the movie, character motivations stopped making sense, plot points were retroactively changed, etc. Prometheus suffered from the same problem, if not to an even greater degree. It's like those movies where everybody cries "studio interference!" ... only in Ridley's case, he's the one who interferes constantly with his own movies.

From TFS: