4 ms·

Because if I run a server - at my own expense - I get to use information provided by the client to determine what, if any, response to provide? This isn’t a ver

Because if I run a server - at my own expense - I get to use information provided by the client to determine what, if any, response to provide? This isn’t a very difficult concept to grasp.

nradov 2y ago
I'm having difficulty grasping the concept. Only a fool would trust any HTTP headers such as User-Agent sent by a random unauthenticated client. Your expenses are your problem.
- marcus0x62 2y ago
  … and I have absolutely no obligation to provide any particular response to any particular client. Parsing, rendering, and trusting that the payload is consistent from request to request is your problem. You can connect to my server, or not. I really don’t care. What you cannot do is dictate how my server responds to your request.
  - nradov 2y ago
    Sure. So just return an HTTP 4XX response to requests you don't like. What's the problem?
    - marcus0x62 2y ago
      Or, I return whatever content I want, within the bounds of the law, based on whatever parameters I decide. What's your problem with that? Again, connect to my server or don't. But don't tell me what type of response I'm obligated to provide you. If I think a given request is from an LLM training module, I don't have any legal obligation whatsoever to return my original content. Or a 400-series response. If I want to intersperse a paragraph from Don Quixote between every second sentence, that's my call.
      - int_19h 2y ago
        But nobody is arguing for that. Instead, what the server owners want is to mandate the clients connecting to them to provide enough information to reliably reject such connections.
        marcus0x62 2y ago
        There are literally people in this thread arguing that it is "unethical" to discriminate based on user agent.
      - skeledrew 2y ago
        This argument of freedom seems applicable on both sides. A site owner/admin is free to return whatever response they wish based on the assumed origin of a request. An LLM user/service is free to send whatever info in the request that elicits a useful response.
        marcus0x62 2y ago
        I don’t have any problem with that.
  - SpaghettiCthulu 2y ago
    > What you cannot do is dictate how my server responds to your request. The client is under no obligation to be truthful in its communications with a server. Spoofing a User-Agent doesn't "dictate" anything. Your server dictates how it responds all on its own when it discriminates against some User-Agents.
    - Too 2y ago
      With enough sophistication and bad intent, at some point being untruthful to a server falls under computer intrusion laws, eg using a password that is not yours. I don't believe spoofing user agent would be determinant for any such case though. Even redistributing secret material you found on an accidentally open S3 bucket, without spoofing UA, could be considered intrusion if it was obvious the material was intended to be secret and you acted with bad intent.
tomjen3 2y ago
This is a technical fact. It is also a technical fact that a client can send any header it wants.
- marcus0x62 2y ago
  I think that is implied in my comment. You can send me whatever request you want, within the bounds of the law. I get to decide, within the bounds of the law, how I respond. Demanding I provide a particular response to every client (and what the parent commenter and others seem to be arguing for) is where I take exception.

Because if I run a server - at my own expense - I get to use information provided by the client to determine what, if any, response to provide? This isn’t a very difficult concept to grasp.

nradov 2y ago

I'm having difficulty grasping the concept. Only a fool would trust any HTTP headers such as User-Agent sent by a random unauthenticated client. Your expenses are your problem.

marcus0x62 2y ago
… and I have absolutely no obligation to provide any particular response to any particular client. Parsing, rendering, and trusting that the payload is consistent from request to request is your problem. You can connect to my server, or not. I really don’t care. What you cannot do is dictate how my server responds to your request.
- nradov 2y ago
  Sure. So just return an HTTP 4XX response to requests you don't like. What's the problem?
  - marcus0x62 2y ago
    Or, I return whatever content I want, within the bounds of the law, based on whatever parameters I decide. What's your problem with that? Again, connect to my server or don't. But don't tell me what type of response I'm obligated to provide you. If I think a given request is from an LLM training module, I don't have any legal obligation whatsoever to return my original content. Or a 400-series response. If I want to intersperse a paragraph from Don Quixote between every second sentence, that's my call.
    - int_19h 2y ago
      But nobody is arguing for that. Instead, what the server owners want is to mandate the clients connecting to them to provide enough information to reliably reject such connections.
      - marcus0x62 2y ago
        There are literally people in this thread arguing that it is "unethical" to discriminate based on user agent.
    - skeledrew 2y ago
      This argument of freedom seems applicable on both sides. A site owner/admin is free to return whatever response they wish based on the assumed origin of a request. An LLM user/service is free to send whatever info in the request that elicits a useful response.
      - marcus0x62 2y ago
        I don’t have any problem with that.
- SpaghettiCthulu 2y ago
  > What you cannot do is dictate how my server responds to your request. The client is under no obligation to be truthful in its communications with a server. Spoofing a User-Agent doesn't "dictate" anything. Your server dictates how it responds all on its own when it discriminates against some User-Agents.
  - Too 2y ago
    With enough sophistication and bad intent, at some point being untruthful to a server falls under computer intrusion laws, eg using a password that is not yours. I don't believe spoofing user agent would be determinant for any such case though. Even redistributing secret material you found on an accidentally open S3 bucket, without spoofing UA, could be considered intrusion if it was obvious the material was intended to be secret and you acted with bad intent.

tomjen3 2y ago

This is a technical fact. It is also a technical fact that a client can send any header it wants.

marcus0x62 2y ago
I think that is implied in my comment. You can send me whatever request you want, within the bounds of the law. I get to decide, within the bounds of the law, how I respond. Demanding I provide a particular response to every client (and what the parent commenter and others seem to be arguing for) is where I take exception.