9 ms·
What are the short-term and long-term implications of this? I assume a drastically increased attack surface and potentially a boon for open-source development?
by SeanAnderson 4y ago
What are the short-term and long-term implications of this?
I assume a drastically increased attack surface and potentially a boon for open-source development? Anything else?
- winddude 4y agoAll of those, assuming there's nothing malicious in the code. Google see if any of their code had been stolen, not like they can do much right now.
- capableweb 4y agoProbably Yandex will start watching their infrastructure very closely, and go through all known attack vectors that haven't been prioritized before to fix them ASAP. Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it.
- EMIRELADERO 4y ago> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. With the current geopolitical situation going on, is this really true? (From a western developer's perspective)
- nyolfen 4y agothe US and russia are both parties to the berne convention, the law still applies even if a bunch of misc russian people and orgs had their assets seized
- EMIRELADERO 4y agoIt's not about whether it applies, but whether there is any will to enforce it. Would the US government cooperate in the indictment and prosecution of a US citizen, on behalf of a de-facto enemy nation, for a company that has ties and is allegedly controlled by the government of said nation?
- nyolfen 4y agoit's not criminal law, yandex can hire a lawyer in the US
- mtnGoat 4y agoBut could they find a judge/jury sympathetic to any Russian concerns?
- fsckboy 4y agocourts decide much more based on law than sympathies, seriously
- FpUser 4y agoYou saying that US judges lack the integrity to issue impartial judgement?
- mtnGoat 4y agoYes, I’m partially implying that and the records speak for themselves.
- dotancohen 4y agoI would love to see the records that you are referring to. Not isolated incidents, rather something suggestive that one could confidently bring a sympathy-based argument in deference of law and expect a high probability of succeeding.
- rcfox 4y agoEven if Russia were at war with the world, it would still be unethical to loot its citizens' property.
- EMIRELADERO 4y agoIntellectual property is a social construct that society decided was important enough. Often times there is no direct correlation between the "effort" and the "compensation" that IP enforcement enables.
- LudwigNagasena 4y agoProperty rights are a social construct regardless of whether the property in question is intellectual. So what?
- vkou 4y agoYou are correct. Any bit of property that you aren't personally in physical possession of is a social construct. Social consensus is the only reason that you can leave your car at the curb, and come back to it a week later, and still expect it to be yours. Social consensus is the only reason that you can own land that you don't personally use. Social consensus is the only thing that prevents people working at your widget factory from deciding on Tuesday that its actually their widget factory, and that they would be better off by cutting out the middleman. There are very rare, very extreme situations in which this kind of social consensus is very prominently broken.
- bobkazamakis 4y agoIt should be treated the same way they've treated royalties.
- The_Colonel 4y agoYandex is complicit in the war and willingly helping Russian government with censorship. Its existence is unethical.
- xwdv 4y ago> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. This is naive. This generation seems very sensitive to the prospect of computer crime. The stolen source code will almost certainly be read, and if deemed novel enough will be turned into open source projects. It may be tough to figure out those projects are derivatives of stolen code, but most likely they will be passed around in black market repos. I looked through some of my telegram channels to see if anything has been posted yet. Lo and behold, the stolen files are in fact available… from a server in Ukraine.
- subw00f 4y ago>This generation seems very sensitive to the prospect of computer crime. You're right. I remember a time, maybe 20 years ago, when stuff like this would be generally appreciated by any community of hackers.
- xwdv 4y agoI think the problem is people are entering a matured industry, all they know is the professional buttoned up culture we have today. People have no further curiosity beyond working and making money in tech. They do not have memories of a time when people tinkered around doing all kinds of crazy and possibly illegal stuff, just for fun, just to see if the could. Sad really.
- medellin 4y agoThe punishments are now somewhat known. I used to tinker with things that were questionable but after seeing what happened to swartz and others i stopped. It’s not worth it.
- dotancohen 4y agoIt is widely suspected that was the goal.
- 4y ago
- fencepost 4y agoany author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. Ah, but will it make its way into Copilot? That could be interesting.
- BonoboIO 4y agoOh that code, Copilot generated it. I m innocent. The Copilot Defence
- unsupp0rted 4y agoI must be writing very obvious glue code because I’ve only ever had copilot suggest very obvious glue code.
- dotancohen 4y agoVery obvious glue code is 95% of what I write. It's the remaining 5% that justify my salary.
- ThePowerOfFuet 4y agoMaking mark on machine: $1 Knowing where to make mark: $9999
- azangru 4y ago> any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Isn't this how learning works in general?
- wizzwizz4 4y ago> What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Not normally. https://en.wikipedia.org/wiki/Not_invented_here#In_computing https://en.wikipedia.org/wiki/Not_invented_here#In_computing More to the point: an organisation will usually use cleanroom techniques to clone something like this, if they choose to do so. Anyone who's been in contact with the original source code is "polluted": https://wiki.winehq.org/Developer_FAQ#Copyright_Issues https://wiki.winehq.org/Developer_FAQ#Copyright_Issues
- fsflover 4y agohttps://en.wikipedia.org/wiki/Clean_room_design https://en.wikipedia.org/wiki/Clean_room_design
- EMIRELADERO 4y agoWorthy to note that the "clean-room" doctrine is not required and even discouraged legally, in favor of more direct source code reading and idea extraction (See Sega v. Accolade and Sony v. Connectix, in which the latter court commented on clean-room being inefficient and the kind of wasted effort that fair use was designed to prevent) The whole point of the idea/expression dichotomy is that copyright doesn't protect ideas. To that end, extracting the uncopyrightable elements out of copyrightable code is more than legal and court-endorsed. Wine's approach just makes me sad, lots of wasted effort on black-box testing where a disssembly of the real code would be legally in the clear and allow it to advance at much better speeds.
- fidgewidge 4y ago
- from 4y agoThey are still the most popular search engine in Russia, they have the best brand, etc. Intangible stuff like that is hard to copy. Running a search engine on the scale of Yandex is very expensive so I don't think that they are going to be replaced by some startup that copies their code and adds a few features. Probably a bunch of bugs will be found but that's not the end of the world. Apparently they handle images pretty well so parts of that may be (illegally) copied in some places.
- Aleksdev 4y agoI can still see many companies trying. If the opportunity is there to make money off of this leak then someone will attempt it.
- SOLAR_FIELDS 4y agoKnowing how stuff like anti-spam algorithms and ranking algorithms work in order to abuse them is probably the much higher value here.
- pshirshov 4y agoThe code is lot less worthy than the data for the models which is lot better guarded and is not in this leak.
- SOLAR_FIELDS 4y agoProbably true. I don’t know much about exploiting algorithms like this, but doesn’t even knowing how the algorithms work give a somewhat substantial advantage in stuff like SEO?
- pshirshov 4y agoFrom my own understanding - not really, most of such stuff is done with ML models. Code worths almost nothing there.
- geraldwhen 4y ago
- deleted 4y ago[deleted]
- rcfox 4y agoUsing stolen code in an open-source project seems like a bad idea.
- EMIRELADERO 4y agoSomeone could still get the uncopyrightable ideas out of it though.
- aflag 4y agoSort of. There may also be pantents involved. It'll be specially hard to defend against it when your inspiration came from the patented code itself.
- BlueTemplar 4y agoAssuming code can even be patented, which generally it cannot.
- SXX 4y agoThen we can train FancyCodeGeneratorModel on it to bypass this unfortunate licensing problem.
- drekipus 4y agoDamn, that's not a bad idea, "convert this code so that it is indistinguishable from the source"
- plugin-baby 4y agoThat shouldn’t be too hard...
- metadat 4y agoDoes the USA care to enforce Russian copyright law anymore? For the near to medium future it seems unlikely to be a priority. Still not a solid foundation to start with, though. Solution: Take kernel of the idea and implement it yourself.
- pshirshov 4y agoIn fact the damage would be mostly reputational. I expect the code to be mostly worthless. There is just too much of it, it's poorly documented and, oftenly, just badly designed and badly written. And the actual important data (index shards, voice models, all that crap) is not in these dumps.
- deleted 4y ago[deleted]
- tazjin 4y agoYandex might be the most popular search engine in Russia, but also they're by far the most popular logistics company for private people here. They do deliveries (food, groceries, other goods), taxis, moving vans and so on - all strongly Yandex branded. If you walk around the streets of Russia's big cities, their brand is absolutely omnipresent (and also in some former Soviet countries, like Armenia). Eating into their business would require much more than source code, but of course an analysis of the code could lead to finding more security issues. > potentially a boon for open-source development? That'd be an absolute copyright/licensing nightmare, just because the code was stolen and published doesn't mean it is now "open-source".
- teetertater 4y agoIn Russia the copyright rules are more relaxed though. As long as you stay small nobody will enforce it
- vbezhenar 4y agoIs it different in other countries? Who checks that local pizzeria uses genuine Windows?
- mschuster91 4y agoWindows? No one unless disgruntled ex-employees blow a whistle. Other stuff like pirated pay-tv streams though? These absolutely have agents on the streets scouting out bars and pubs to check if they're paying customers and if they are actually using an (expensive) commercial license or if they are mis-using a residential one.
- kortilla 4y agoMicrosoft.
- iavael 4y agoNo, they are not. Laws are about the same.