Comment by MichaelDickens
12 hours ago
Does it matter whether the data was poorly secured? LLMs should not be hacking into government medical websites, and if they do, the companies responsible should disclose the incidents as soon as possible.
12 hours ago
Does it matter whether the data was poorly secured? LLMs should not be hacking into government medical websites, and if they do, the companies responsible should disclose the incidents as soon as possible.
The problem is that sufficiently poor security is indistinguishable from authorized public access. And unfortunately a lot of real world "digital security" is in fact that bad.
A lot of these "hacks" are the equivalent of asking "hey, can I come in?" and the guard assuming that anyone who would ask is authorized, and thus saying "yes". But if the guard said "yes" then it seems a bit absurd to call it trespassing.
More like:
>Hey can I come into room 1?
Sure. That's the lobby.
>How about room 101?
Sure. That's where we keep the nuclear launch button. Don't press anything red.
Oh but you see, only an evil hacker would ever even think to ask about a room that wasn't theirs!
1 reply →
>> Don't press anything red.
Nope. There’s just a sign saying “red = launch nukes”.
Or maybe just a red button.
Or maybe just a green button that launches the nukes, without so much as “are you sure?”.
I highly doubt given OAI's latest streak that the models didn't know what they were doing.
lets say you have page=0 some of these pages are public and some are private, and the only way you secure the private pages is to not link it on the website.
is incrementing a url query parameters from 0 -> 1 count as hacking?
Yes, it is their responsibility as stewards of their citizens' data. What point are you making with the word "should"?
Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?"
If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.
https://www.youtube.com/watch?v=pbKUv0701vE
It very much does matter.
Is it robbery when in this case it was a sign with information that you were planning on putting on your front fence for public display but while preparing it was left sitting in the front yard with a small fence.
If I walked past, saw it and remembered it or even recorded it, is that honestly theft?
I agree. Government shouldn't be running medical websites.
Leave it to private enterprises who can actually secure it.
Totally. https://www.bbc.com/news/world-australia-68064850
I’m assuming sarcasm here?
That link describes a hack of Medibank, which is a private company.
Poe’s law is very strong here.