Hacker Newsnew | past | comments | ask | show | jobs | submit | gruez's commentslogin

>Using notepad++ (or whatever other program) in a manner that deals with internet content a lot - then updating is the thing.

Disagree. It's hard to screw up a text editor so much that you have buffer overflows 10 years after it's released, so it's probably safe. It's not impossible, but based on a quick search (though incomplete because google is filled with articles describing this incident) it doesn't look like there were any vulnerabilities that could be exploited by arbitrary input files. The most was some dubious vulnerability around being able to plant plugins.


You basically need to make a trade-off between 0days and supply chain attacks. Browsers, office suite, media players, archivers, and other programs that are connected to the internet and are handling complex file formats? Update regularly, or at least keep an eye out for CVEs. A text editor, or any other program that doesn't deal with risky data? You're probably fine with auto update turned off

>I guess the idea is to find systems vulnerable to 0-day exploits and similar based on this info?

You don't need 0days when you already have RCE on an unsandboxed system.


The updater doesn't check the certificate of the updated installer, it just executes whatever.

>Sabu was put under pressure by the FBI, they threatened to place his kids into foster care.

>That was legal. Guess what, similar things would be legal in France.

lawfare is... good now? Between Trump being hit with felony charges for falsifying business records (lawfare is good?) and Lisa Cook getting prosecuted for mortgage fraud (lawfare is bad?), I honestly lost track at this point.

>The same way the president of the USA can order a Drone strike on a Taliban war lord, the president of France could order Musks plane to be escorted to Paris by 3 Fighter jets.

What's even the implication here? That they're going to shoot his plane down? If there's no threat of violence, what does the French government even hope to achieve with this?


fighter jets ARE a threat of violence, and it is widely understood and acknowledged.

Again: the threat is so clear that you rarely have to execute on it.


>fighter jets ARE a threat of violence, and it is widely understood and acknowledged.

That's not a credible threat because there's approximately 0% chance France would actually follow through with it. Not even Trump would resort to murder to get rid of his domestic adversaries. As we seen the fed, the best he could muster are some spurious prosecutions. France murdering someone would put them on par with Russia or India.


Don’t forget that captain of the plane makes decisions not Elon.

If captain of the plane disobeyed direct threat like that from a nation, his career is going to be limited. Yeah Elon might throw money at him but that guy is most likely never allowed again to fly near any French territory. I guess whole cabin crew as well .

Being clear for flying anywhere in the world is their job.

Would be quite stupid to loose it like truck driver DUI getting his license revoked.


>Don’t forget that captain of the plane makes decisions not Elon.

>If captain of the plane disobeyed direct threat like that from a nation, his career is going to be limited. Yeah Elon might throw money at him but that guy is most likely never allowed again to fly near any French territory. I guess whole cabin crew as well .

Again, what's France trying to do? Refuse entry to France? Why do they need to threaten shooting down his jet for that? Just harassing/pranking him (eg. "haha got you good with that jet lmao")?


> lawfare is... good now?

Well, when everything is lawfare it logically follows that it won't always be good or always be bad. It seems Al Capone being taken down for tax fraud would similarly be lawfare by these standards, or am I missing something? Perhaps lawfare (sometimes referred to as "prosecuting criminal charges", as far as I can tell, given this context) is just in some cases and unjust in others.


Right, because LLMs aren't spitting out textbooks verbatim, or at least are vaguely adding safeguards against it. The students aren't being sued for ingesting pirated books, they're getting sued for sharing them.

>The Rights Alliance confirmed it will begin filing civil lawsuits against individual students who are caught sharing even a single digital textbook.


>because LLMs aren't spitting out textbooks verbatim

Except that via the right prompt injections, some LLMs were caught they could spit out chapters of LoTR or Harry Potter 90% verbatim.

Safeguards LLMs implemented to prevent the output from being verbatim and to be considered legally transformative, are not legitimizing the IP theft, they're just covering it up, kind of like evidence spoliation.

But that's just my opinion, the courts will have to decide this one.


>Safeguards LLMs implemented to prevent the output from being verbatim and to be considered legally transformative, are not legitimizing the IP theft, they're just covering it up, kind of like evidence spoliation.

Is it also "evidence spoliation" for Google Books to resist attempts to dumping out all pages of a book?


Did Google books obtain the rights to the books legally or illegally?

That's irrelevant on two counts:

1. Not all LLMs were trained on illegally obtained books, and there's at least one court case where the use of illegal obtained books has been ruled illegal (exact sanctions are TBD)

2. In the context of discussing LLMs or students illegally distributing books, whether they obtained it legally is irrelevant. If you bought a book legally, that still doesn't give you the right to photocopy it and send to your friends.


He's being sarcastic (hopefully).

If you strip out the swarm logic (ie. downloading from multiple peers), you're just left with a protocol that transfers big files via chunks, so there's no reason that'd be faster than any other sort of download manager that supports multi-thread downloads.

https://en.wikipedia.org/wiki/Download_manager


>I don't have a contract with the advertiser to provide genuine data back about what ads I've clicked and what I haven't.

Charges of fraud doesn't require a contract to be in place. That's the whole point of criminal law, it's so that you don't need to add a "don't screw me over" clause to every interaction you make.


How is that a fraud, when I don't get any money from the scheme?


By this logic, vandalism would be fraud too.

Vandalism involves making material misrepresentations?

Damaging property cost money to fix.

Where's the misrepresentation?

>Don't tell me I'm not allowed to click buttons you put in my face.

No, the illegal-ness doesn't come from the clicking, it comes from the fact you're clicking with the intention of defrauding someone. That's also why filling out a credit card application isn't illegal, but filling out the same credit card application with phony details is.


The intent isn’t to defraud. The intent is to curb their uninvited data collection and anti-utility influence on the internet.

You’re not defrauding anyone if you have your extension click all ads in the background and make a personalized list for you that you can choose to review.

The intent is convenience and privacy, not fraud.


>The intent isn’t to defraud. The intent is to curb their uninvited data collection and anti-utility influence on the internet.

How's this any different than going around and filling out fake credit applications to stop "uninvited data collection" by banks/credit bureaus or whatever?

>The intent is convenience and privacy, not fraud.

You're still harming the business, so my guess would be something like tortious interference.

https://en.wikipedia.org/wiki/Tortious_interference


In a credit application there is a signature and binding contract. If I fill in false information knowingly, the intent is clear and written.

If you send me an unsolicited mailer with a microchip that tracks my eyes and face as I read it, you’ve already pushed too far. To then claim my using a robot to read it for me is fraud ignores the invasion of privacy you’ve already instituted without my express consent (digital ads are this).

It’s not fraud if it’s self-defense from corporate overreach.


>In a credit application there is a signature and binding contract. If I fill in false information knowingly, the intent is clear and written.

At best that gets you off the hook of fraud charges, but not tort claims, which are civil, and don't require intent.

>It’s not fraud if it’s self-defense from corporate overreach.

There's no concept of "self-defense" when it comes to fraud, or torts.


I am super curious how far this goes. If, hypothetically, I wore some sort of glasses that kept facial recognition from identifying and tracking me at my local grocery store, would that constitute a civil infringement in the future?

What about extensions that skip embedded ads in a YouTube video? Is that tortuous interference with the view counter that creators use to market their reach?


>How's this any different than going around and filling out fake credit applications to stop "uninvited data collection" by banks/credit bureaus or whatever?

It's so different that it can't even be compared. There's nothing similar there.

>>The intent is convenience and privacy, not fraud.

> You're still harming the business, so my guess would be something like tortious interference.

No, you're not harming the business. You're simply not following the business idea of the "business". Anyone can have a business idea of some type. Not a single person on earth has any obligation to fulfill that business idea. But somehow some people believe the opposite.


> No, the illegal-ness doesn't come from the clicking, it comes from the fact you're clicking with the intention of defrauding someone. That's also why filling out a credit card application isn't illegal, but filling out the same credit card application with phony details is.

You might technically be right. But I'd recommend contacting EFF, if, somehow, installing AdNauseam brings you into legal trouble.

On the realm of search engines and ad networks I love to remind people that Google took out "don't be evil" from their motto and pressured anyone within US jurisdiction to remove Page and Brin's appendix #8 (at the least it's removed from their original school of Stanford).

8 Appendix A: Advertising and Mixed Motives https://www.site.uottawa.ca/~stan/csi5389/readings/google.pd...


http://infolab.stanford.edu/pub/papers/google.pdf

stanford.edu, and the appendix is there. In fact on the link you gave the appendix is cut short - looks like an OCR/copying issue but then at a glance it doesn't seem to happen elsewhere which is a little suspicious. I'm not sure what you're talking about.


I must have somehow missed that one; glad that ancient site without HTTPS is still up. Here are the two top results I get from searching for it from Stanford[0][1], and you can see that this section of the appendix is missing. Google's also has it missing[2]. So no, I don't think I'm crazy.

[0] http://ilpubs.stanford.edu:8090/361/1/1998-8.pdf

[1] https://snap.stanford.edu/class/cs224w-readings/Brin98Anatom...

[1] https://research.google/pubs/the-anatomy-of-a-large-scale-hy...


Even if they are wrong:

1: Ad companies are not going to go after individual users, rather they would target the maker of any such plugin

2: If they did go after an individual user, they would have to prove damages, and an individual is unlikely to do more than a few bucks of wasted ad spend for a company, not even a rounding error, making the legal cost and political cost of targeting the person running the script enormous compared to the potential return from anything other than a grand slam nuclear judgement in their favor.


What if someone unironically wants to automatically click all the ads to support the websites they visit

You'd be doing way more harm than good. The battle between ad networks and unscrupulous website owners using bots to fake ad clicks has been going on forever.

Some sort of Robinhood of advertising, taking from the big, to give to the small

Ads pay in different forms. Some pay per click (PPC), some pay per thousand impressions (CPM).

Clicking with the intention of helping doesn't help. Only clicking with genuine interest helps.


I don't think the question was about whether this would actually help the advertisers. (I suspect it was rhetorical.) Of course the defense will now be harder to execute for anyone who reads this thread.

Even one of the users here above mentions the malicious intent:

> I hate advertisers so I'm gonna get back at them by making them pay more.


> it comes from the fact you're clicking with the intention of defrauding someone.

You're defrauding nobody. People purchase visibility and clicks when they purchase advertising. not conversions or sales.


>People purchase visibility and clicks when they purchase advertising. not conversions or sales.

Again, you're ignoring intent in all of this. It's not illegal to default on a loan, or even to refuse to pay it back (eg. bankruptcy), but it is illegal to take out a loan with the specific intent to not pay it back (eg. if you know you're planning on declare bankruptcy right afterwards).


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: