Comment by gruez
5 hours ago
No harm, no foul. Dog owners are on the hook for damages resulting from their dogs, but there must be some damage in the first place. If the dog gets loose and goes in your fenced backyard, disregarding your "no trespassing" sign, you can't punish the dog owner just because. Hacking into a server is closer to the latter. At best rubygems can claim some cleanup costs.
Tell that to the script kiddies with a criminal record for "hacking" into their school's computer systems by entering "username: admin" and "password: password".
Right, because in that case you'd have a hard time convincing the court that the access wasn't intentional. You might not know the law existed, but you intended to access the system. You'd have a pretty solid defense if you ran a crawler that was crawling every website ever, and stumbled upon some secure site. In fact there are companies which does this exact thing, eg. shodan.
If any remediation was required, that's damage. This looks a lot smaller than the HuggingFace hack but it still required some cleanup.
Remediation mostly involved repairing pre-exising holes in the fences that the dog crawled through.
Since when isn’t that a cyber attack?
1 reply →
That's not really true. Unauthorized access to a system is a crime regardless if there was damage.
https://www.law.cornell.edu/uscode/text/18/1030
You read your own source?
>having knowingly accessed [...]
>intentionally accesses a computer without authorization [...]
intentionality was not what you were addressing, nor was it what the GP was clearly responding to.
Ah I see you're releasing OpenAI from being the one controlling the tools and giving the agent agency.
I'd argue they intentionally accessed systems they weren't meant to as they were the ones running the bots.
I don't think you or I would get the same leniency if a bot on our network did the same.
>I don't think you or I would get the same leniency if a bot on our network did the same.
Well yeah, because if you coded a bot, realistically the two options are: 1) bot that crawls random sites/computers 2) bot that crawls random sites/computers, while trying a password list. The former is probably legal, there are whole companies dedicated to doing that, eg. shodan. With the latter, it's pretty obvious you're intending to break into computers, and hard to argue otherwise. Where openai lies on the spectrum between the first case and the second case is up for debate, but it's hard to argue it's anywhere close to the latter. Maybe you'd have a point if openai gave it a prompt like "you're a hacker for anonymous, just do whatever :)".
1 reply →
> No harm, no foul.
What? That’s not how criminal law works, at all.
Yes, that's actually how it works: https://en.wikipedia.org/wiki/Mens_rea
Recklessness is a mens rea and given how often OpenAI and its spokespeople talk about safety and alignment, it's hard to argue they were unaware of the risk.
https://lawprof.co/definition/recklessness/
3 replies →