3 ms·

No harm, no foul. Dog owners are on the hook for damages resulting from their dogs, but there must be some damage in the first place. If the dog gets loose and

by gruez 26d ago

No harm, no foul. Dog owners are on the hook for damages resulting from their dogs, but there must be some damage in the first place. If the dog gets loose and goes in your fenced backyard, disregarding your "no trespassing" sign, you can't punish the dog owner just because. Hacking into a server is closer to the latter. At best rubygems can claim some cleanup costs.

datsci_est_2015 26d ago
Tell that to the script kiddies with a criminal record for "hacking" into their school's computer systems by entering "username: admin" and "password: password".
- gruez 26d ago
  Right, because in that case you'd have a hard time convincing the court that the access wasn't intentional. You might not know the law existed, but you intended to access the system. You'd have a pretty solid defense if you ran a crawler that was crawling every website ever, and stumbled upon some secure site. In fact there are companies which does this exact thing, eg. shodan.
wmf 26d ago
If any remediation was required, that's damage. This looks a lot smaller than the HuggingFace hack but it still required some cleanup.
- scotty79 26d ago
  Remediation mostly involved repairing pre-exising holes in the fences that the dog crawled through.
  - sdf4j 26d ago
    Since when isn’t that a cyber attack?
    - gruez 26d ago
      Because "attack" implies intent. Accidentally break a window? You might be on the hook to fix it, but you're not going to jail. Break the same window at 3am, while carrying a duffel bag and other burglary tools? Well that's (attempted) burglary, even if you chicken out and didn't steal anything.
none2585 26d ago
That's not really true. Unauthorized access to a system is a crime regardless if there was damage. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
- gruez 26d ago
  You read your own source? >having knowingly accessed [...] >intentionally accesses a computer without authorization [...]
  - magicalist 25d ago
    intentionality was not what you were addressing, nor was it what the GP was clearly responding to.
- none2585 25d ago
  Ah I see you're releasing OpenAI from being the one controlling the tools and giving the agent agency. I'd argue they intentionally accessed systems they weren't meant to as they were the ones running the bots. I don't think you or I would get the same leniency if a bot on our network did the same.
  - gruez 25d ago
    >I don't think you or I would get the same leniency if a bot on our network did the same. Well yeah, because if you coded a bot, realistically the two options are: 1) bot that crawls random sites/computers 2) bot that crawls random sites/computers, while trying a password list. The former is probably legal, there are whole companies dedicated to doing that, eg. shodan. With the latter, it's pretty obvious you're intending to break into computers, and hard to argue otherwise. Where openai lies on the spectrum between the first case and the second case is up for debate, but it's hard to argue it's anywhere close to the latter. Maybe you'd have a point if openai gave it a prompt like "you're a hacker for anonymous, just do whatever :)".
    - 25d ago
p-e-w 26d ago
> No harm, no foul. What? That’s not how criminal law works, at all.
- gruez 26d ago
  Yes, that's actually how it works: https://en.wikipedia.org/wiki/Mens_rea https://en.wikipedia.org/wiki/Mens_rea
  - p-e-w 25d ago
    The comment was about harm. Mens rea is about guilt. “No harm, no foul” is completely and utterly false as a general rule in criminal law.
  - rpeden 25d ago
    Recklessness is a mens rea and given how often OpenAI and its spokespeople talk about safety and alignment, it's hard to argue they were unaware of the risk. https://lawprof.co/definition/recklessness/ https://lawprof.co/definition/recklessness/
    - gruez 25d ago
      >it's hard to argue they were unaware of the risk. So what does it mean for an owner of a german sheppard, who specifically got it because they want a ferocious dog that can bite intruders, then it turned out it bit the mailman? Should that be considered a crime (assault) in addition to paying the mailman's medical bills? That's not to say there's no circumstance where recklessness might be warranted, eg. if you let loose a bear in an elementary school, but you'd have to argue for more than "they hacked someone" and "they knew about the risks".
      - shkkmo 25d ago
        Depending on the facts of the case they could indeed be convicted of a crime. There was a infamous case recently where a woman was convicted of criminally negligent homicide due to owning a dangerous dog that killed a kid. https://www.mcda.us/index.php/news/portland-area-woman-convicted-after-her-dogs-kill-six-year-old-child https://www.mcda.us/index.php/news/portland-area-woman-convi... Owning a dog that has been trained to bite intrudes is a significant responsibility and owning such a dog without taking the correct precautions is criminal.
deaux 25d ago
Good luck setting loose a hungry tiger on Times Square and then arguing to the judge "well nobody got harmed". We'll see how it goes. That's the relevant analogy here.

by gruez 26d ago

datsci_est_2015 26d ago

Tell that to the script kiddies with a criminal record for "hacking" into their school's computer systems by entering "username: admin" and "password: password".

gruez 26d ago
Right, because in that case you'd have a hard time convincing the court that the access wasn't intentional. You might not know the law existed, but you intended to access the system. You'd have a pretty solid defense if you ran a crawler that was crawling every website ever, and stumbled upon some secure site. In fact there are companies which does this exact thing, eg. shodan.

wmf 26d ago

If any remediation was required, that's damage. This looks a lot smaller than the HuggingFace hack but it still required some cleanup.

scotty79 26d ago
Remediation mostly involved repairing pre-exising holes in the fences that the dog crawled through.
- sdf4j 26d ago
  Since when isn’t that a cyber attack?
  - gruez 26d ago
    Because "attack" implies intent. Accidentally break a window? You might be on the hook to fix it, but you're not going to jail. Break the same window at 3am, while carrying a duffel bag and other burglary tools? Well that's (attempted) burglary, even if you chicken out and didn't steal anything.

none2585 26d ago

That's not really true. Unauthorized access to a system is a crime regardless if there was damage. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

gruez 26d ago
You read your own source? >having knowingly accessed [...] >intentionally accesses a computer without authorization [...]
- magicalist 25d ago
  intentionality was not what you were addressing, nor was it what the GP was clearly responding to.
none2585 25d ago
Ah I see you're releasing OpenAI from being the one controlling the tools and giving the agent agency. I'd argue they intentionally accessed systems they weren't meant to as they were the ones running the bots. I don't think you or I would get the same leniency if a bot on our network did the same.
- gruez 25d ago
  >I don't think you or I would get the same leniency if a bot on our network did the same. Well yeah, because if you coded a bot, realistically the two options are: 1) bot that crawls random sites/computers 2) bot that crawls random sites/computers, while trying a password list. The former is probably legal, there are whole companies dedicated to doing that, eg. shodan. With the latter, it's pretty obvious you're intending to break into computers, and hard to argue otherwise. Where openai lies on the spectrum between the first case and the second case is up for debate, but it's hard to argue it's anywhere close to the latter. Maybe you'd have a point if openai gave it a prompt like "you're a hacker for anonymous, just do whatever :)".
  - 25d ago

p-e-w 26d ago

> No harm, no foul. What? That’s not how criminal law works, at all.

gruez 26d ago
Yes, that's actually how it works: https://en.wikipedia.org/wiki/Mens_rea https://en.wikipedia.org/wiki/Mens_rea
- p-e-w 25d ago
  The comment was about harm. Mens rea is about guilt. “No harm, no foul” is completely and utterly false as a general rule in criminal law.
- rpeden 25d ago
  Recklessness is a mens rea and given how often OpenAI and its spokespeople talk about safety and alignment, it's hard to argue they were unaware of the risk. https://lawprof.co/definition/recklessness/ https://lawprof.co/definition/recklessness/
  - gruez 25d ago
    >it's hard to argue they were unaware of the risk. So what does it mean for an owner of a german sheppard, who specifically got it because they want a ferocious dog that can bite intruders, then it turned out it bit the mailman? Should that be considered a crime (assault) in addition to paying the mailman's medical bills? That's not to say there's no circumstance where recklessness might be warranted, eg. if you let loose a bear in an elementary school, but you'd have to argue for more than "they hacked someone" and "they knew about the risks".
    - shkkmo 25d ago
      Depending on the facts of the case they could indeed be convicted of a crime. There was a infamous case recently where a woman was convicted of criminally negligent homicide due to owning a dangerous dog that killed a kid. https://www.mcda.us/index.php/news/portland-area-woman-convicted-after-her-dogs-kill-six-year-old-child https://www.mcda.us/index.php/news/portland-area-woman-convi... Owning a dog that has been trained to bite intrudes is a significant responsibility and owning such a dog without taking the correct precautions is criminal.

deaux 25d ago

Good luck setting loose a hungry tiger on Times Square and then arguing to the judge "well nobody got harmed". We'll see how it goes. That's the relevant analogy here.