6 ms·

I think that if Hugging Face had filed a police report that OpenAI could have been charged with a crime. I’m partially surprised that they didn’t do exactly th

I think that if Hugging Face had filed a police report that OpenAI could have been charged with a crime. I’m partially surprised that they didn’t do exactly that. If I ran a corporation I would assume any intrusion attempt by another company was intentional. Why wouldn’t I? Corporate espionage is super common. I assume the answer is that these executives know each other personally.

john_strinlai 2mo ago
charged is possible, however i doubt there would be a conviction for the reasons i stated (no intent).
- Grombobulous 2mo ago
  I think it’s most likely you’re right, but I’m the weirdo who thinks there’s actually a non-zero probability that there was negative intent and that the “accidental” aspect is a form of damage control. If someone broke into my house but then claimed they didn’t mean to when they saw I was home, I’m not sure I’d take them at their word.
  - user43928 2mo ago
    You think that a training run in a VM that was set up with access only to an internal package repository was intended to hack said repository to then go on and hack HF? All so that OpenAI could do a bit of bragging and massively delay their own work and planned model rollouts? That seems extremely unlikely.
    - Grombobulous 2mo ago
      That’s all dependent on believing the premise of the story given by OpenAI. Was it really a training run in a VM? Was it really only intended to touch an internal repository? How do we/HF know and verify that? I agree with you that it’s unlikely, but it’s not out of the realm of possibility. Corporations have intentionally committed felonies many times.
      - user43928 2mo ago
        As far as I recall the vendor of the repository patched the exploited vulnerability, so that checks out. Considering that there would be no clear benefit to such criminal behavior, in my opinion "unlikely" is putting it mildly.
sebzim4500 2mo ago
What possible upside exists for Hugging Face to go after one of their most important partners in that way?
- Grombobulous 2mo ago
  That’s exactly why I think they ultimately let the issue slide.
pixl97 2mo ago
Companies are not quick to open up police investigations in situations that run deep into their infrastructure and management. You open up a gigantic hole of discovery and a possible huge time sink of a legal battle. I've known multiple privately held companies that have quietly settled incidents where amounts between 250,000 and 1,000,000 were embezzled because the fallout from having that in the public record would have been much more expensive. So yea, it's one of those perverse situations. If you steal $1 from the company they will hammer you with the law, but if you steal a million suddenly the decision tree on what to do is far more complex.

john_strinlai 2mo ago

charged is possible, however i doubt there would be a conviction for the reasons i stated (no intent).

Grombobulous 2mo ago
I think it’s most likely you’re right, but I’m the weirdo who thinks there’s actually a non-zero probability that there was negative intent and that the “accidental” aspect is a form of damage control. If someone broke into my house but then claimed they didn’t mean to when they saw I was home, I’m not sure I’d take them at their word.
- user43928 2mo ago
  You think that a training run in a VM that was set up with access only to an internal package repository was intended to hack said repository to then go on and hack HF? All so that OpenAI could do a bit of bragging and massively delay their own work and planned model rollouts? That seems extremely unlikely.
  - Grombobulous 2mo ago
    That’s all dependent on believing the premise of the story given by OpenAI. Was it really a training run in a VM? Was it really only intended to touch an internal repository? How do we/HF know and verify that? I agree with you that it’s unlikely, but it’s not out of the realm of possibility. Corporations have intentionally committed felonies many times.
    - user43928 2mo ago
      As far as I recall the vendor of the repository patched the exploited vulnerability, so that checks out. Considering that there would be no clear benefit to such criminal behavior, in my opinion "unlikely" is putting it mildly.

sebzim4500 2mo ago

What possible upside exists for Hugging Face to go after one of their most important partners in that way?

Grombobulous 2mo ago
That’s exactly why I think they ultimately let the issue slide.

pixl97 2mo ago

Companies are not quick to open up police investigations in situations that run deep into their infrastructure and management. You open up a gigantic hole of discovery and a possible huge time sink of a legal battle. I've known multiple privately held companies that have quietly settled incidents where amounts between 250,000 and 1,000,000 were embezzled because the fallout from having that in the public record would have been much more expensive. So yea, it's one of those perverse situations. If you steal $1 from the company they will hammer you with the law, but if you steal a million suddenly the decision tree on what to do is far more complex.