4 ms·
In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secu
by reedf1 2mo ago
In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secured by obscurity rather than any high quality rigorous authorization. The only thing it would make absolutely clear at a legal level is that you do not want the API to be publicly used, but for a jury/judge accessing an unadvertised API via browser tools is hacking.
- ra 2mo agoI'm pretty sure that's not universally true. IANAL but I believe the legality depends on location and context.
- torginus 2mo agoI think this is the solution to a lot of AI 'alignment' issues. We have laws, and LLMs should NEVER break them unless the user states its fine with some qualifying condition. Yes, every country has a different legal system, but I think there's a decent idea of what constitutes intrusion thats agreed on in most parts of the world. In grey area scenarios, the user should be able to override this, with a warning of clear consequences of, and should they accept, users should be held criminally liable. If the LLM does so unprompted, the responsibility should be the providers'. LLMs should be considered tools, legally speaking.
- reedf1 2mo agoI do think one day that LLMs may be so 'aligned' that hacking culture will have a resurgence in some way. In the sense that the only way to do anything a bit below board will be done manually.
- close04 2mo agoAnd to be clear, this isn't an "I just walked through an open door" situation. This is getting in the house through a 2nd floor open window, destroying some items and putting some of your own in their place. > the bot explained that it had manipulated the system to book him onto classes months in advance - against the normal rules of the system. > The agent replied saying it had succeeded by cancelling another gym-goer's booking. This wasn't just breaking the rules of the gym, it also caused damages to someone. Someone had their booking canceled, maybe lost some money, definitely lost time dealing with this topic.
- graemep 2mo agoWould phoning them and pretending to be someone ahead of you in a queue to cancel their reservation be a crime? probably, but not one likely to get prosecuted.
- lbreakjai 2mo ago> This is getting in the house through a 2nd floor open window I disagree. If an endpoint is open, my assumption is that it's free for me to call, the same way I expect to be able to purchase items on the shelf at the store. If you fail to clearly label or separate them, that's on you.
- close04 2mo ago> I disagree. If an endpoint is open, my assumption is The famous "innocent as long as their assumption was" defense. "If the window is open, my assumption is" works the same way. The law is clear on this, no need to make assumptions. The guy knew immediately the agent broke the rules. A modicum of common sense tells you that those actions can't possibly be above board. The gym will probably let him off the hook and not press charges but not because he was entitled to do it. > the same way I expect to be able to purchase items on the shelf at the store I'll try to make my point using the same logic. Why "purchase"? Each item isn't clearly labeled as "must be purchased before exiting the store". And why just from the shelf? Why not the shelf itself? Why not "items from a desk drawer in a back room of the store", or even "items from the pocket of a cashier"? They're all right there, unlocked, and unlabeled. > If you fail to clearly label Do you carry a visible label with things people are not allowed to do to you? Without that label do others often make the same assumption you do? :)