Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

QBittorrent breaks out of sandbox to commit crimes

beige.party

Post reply on HN
Print view View original

51–60 of 304 posts

Re: QBittorrent breaks out of sandbox to commit crimes

#51

Post by mindslight »

weberer wrote: post #14
mraniki wrote: post #2

I'll copy the whole announcement here for those who don't want to click: > I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this…

Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.

It's understandable when you see that the ethos is to have software that represents the user in charge of the rendering, rather than centralizing it all on the server. There is a major difference between common "app store apps" or hostile javascript bundled with websites, versus software that's been written to work in the user's interest. However as they use similar delivery methods, it's understandable that it takes a minute to think through and revisit your assumptions that have lead to being default anti- javascript or app.

Re: QBittorrent breaks out of sandbox to commit crimes

#52

Post by peri-cl »

weberer wrote: post #14
mraniki wrote: post #2

I'll copy the whole announcement here for those who don't want to click: > I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this…

Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.

Mastodons will also respond to a plain "application/json" HTTP request, no cruft,

    curl 'https://beige.party/api/v1/statuses/117057396732763183' | jq '.content'

Re: QBittorrent breaks out of sandbox to commit crimes

#53

Post by micromacrofoot »

serf wrote: post #32
fragmede wrote: post #21

Earlier quoted context omitted.

"Certifiably insane" to enable JavaScript, which was invented in 1995, or install an app, which first happened on the Palm series of smartphones in 1996. Either of those are "certifiably insane"? For reference, the term neurodiversity was coined circa 1998.

Neither the invention date or the mental health terminology have anything to do with the fact that js being commonplace is a privacy and security nightmare -- which was actually the point.

JavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way... and "privacy and security nightmare" can be used to describe most of the internet at this point with or without it

Re: QBittorrent breaks out of sandbox to commit crimes

#54

Post by collingreen »

ghosty141 wrote: post #43
ryandrake wrote: post #22

Love it. AI as Responsibility Laundering. Like the gun that kills people rather than the murderer.

I never understood how anybody would think this way. At work for example from day one of using AI our rule was, AI is just a tool and if you break something due to not reviewing the code properly etc. it's on you as if you wrote that code yourself.

Nobody ACTUALLY thinks this way, they just want to break all the laws and make their billions without any consequences. We've already seen the big ai labs turn around and cry foul when others try to use their content but they are happy to continue doing it themselves.

The hypocrisy and willingness to play dumb are kind of staggering.

Re: QBittorrent breaks out of sandbox to commit crimes

#56

Post by tomrod »

weberer wrote: post #14
mraniki wrote: post #2

I'll copy the whole announcement here for those who don't want to click: > I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this…

Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.

Treating HTML as a bootloader for an app has always felt like the wrong pattern to me. Outside of Authn/passkeys, it would seem a person could do basically everything in HTML (but, to be frank, I am not a front end dev and would welcome correction).

Re: QBittorrent breaks out of sandbox to commit crimes

#57

Post by ryandrake »

ghosty141 wrote: post #43
ryandrake wrote: post #22

Love it. AI as Responsibility Laundering. Like the gun that kills people rather than the murderer.

I never understood how anybody would think this way. At work for example from day one of using AI our rule was, AI is just a tool and if you break something due to not reviewing the code properly etc. it's on you as if you wrote that code yourself.

Well, responsibility laundering isn't exactly new. People use corporations to diffuse responsibility and avoid punishment for crimes all the time. "The corporation did it, not the decision makers in the corporation!"

Re: QBittorrent breaks out of sandbox to commit crimes

#58

Post by mmooss »

innocent_name wrote: post #8

it's funny to see the very same pro piracy, pro AI edgelords suddenly getting all riled up against the alleged copyright infringements. I remember a socialistic coworker of mine—that was bragging about his -arr setup—talking about the end of the culture because authors aren't earning money.

This false (IMHO) equivalency is weapon people like to keep handy these days, ready to shoot at any target.

There is all the difference in the world between the scenarios. The argument's popularity seems to be born in the argument, more popular on HN, that American white / Christian / males (or some subset of those factors) face discrimination by programs to benefit minorities / women.

What is the difference? It is power. Punching up or protecting the politically vulnerable is a completely different act than punching down or empowering the already powerful and oppressing the vulnerable. Punching down causes the vulnerable to be oppressed (jailed or otherwise restricted in who, where, what, when, etc they can do and be), impoverished, and killed - by definition, they are vulnerable. The powerful have their power challenged, which is many times appropriate among free people where 'all are created equal' and have the same rights.

In the case of artistic media - songs, books, etc. - private people downloading art to use it as art are spreading art and empowering themselves at the expense of powerful interest who have seized control of the art. That's much different than powerful people taking the art to increase their own profit and power, and to significantly displace and distort the art.

(I'm oversimplifying for these purposes: The fact that artists don't get paid by the former, and that it's anarchy used for bad things too, are serious problems.)

> socialistic

You're giving away your biases. Only a certain group calls everything they don't like 'socialism'. It's libertarianism or anarchism. Socialists might say, for example, the state should control distribution of media.

Re: QBittorrent breaks out of sandbox to commit crimes

#59

Post by tomrod »

micromacrofoot wrote: post #53
serf wrote: post #32

Earlier quoted context omitted.

Neither the invention date or the mental health terminology have anything to do with the fact that js being commonplace is a privacy and security nightmare -- which was actually the point.

JavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way... and "privacy and security nightmare" can be used to describe most of the internet at this point with or without it

It can certainly come across as a "weird trend" but I've found that the most insistent for disabling JS are the folks who have deep knowledge of browsers and the security plane running webapps. YMMV.
Post reply on HN