Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenAI bots knew about the RubyGems caching vulnerability

tenderlovemaking.com

Post reply on HN
Print view View original

371–380 of 400 posts

Re: OpenAI bots knew about the RubyGems caching vulnerability

#371

Post by CJefferson »

bayindirh wrote: post #263
vipshek wrote: post #257

In the physical world, it seems like when an tool/device/instrument causes harm (or is used to cause harm), we assign blame to either the user of the tool or its creator. When do we blame the user? When the tool is operating as intended by its creator, and we agree the tool meets certain quality standards and isn't defective. When do we blame the creator? When the device doesn't meet those quality standards and reaso…

That's a good idea, but a physical device is deterministic most of the time (if not always). E.g.: A lawnmower, as credited by the great Bryan Cantrill. However an AI agent, or the model powering it is stochastic by design. How can you certify something which doesn't behave the same twice, and more importantly we don't understand how it works 100%? BTW, really, how is that AI observability work is going in the fronti…

I could make a non-deterministic chainsaw fairly easily. I’d also get sued into the ground if I sold it, and I wouldn’t be able to claim ‘Oh, it’s just an unavoidable part of progress’.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#373

Post by nhinck2 »

Gorath wrote: post #365
henry2023 wrote: post #362

Earlier quoted context omitted.

Obviously you.

Not as obvious as you may think depending on your states laws for liability. https://law.justia.com/cases/california/court-of-appeal/3d/1...

That case had the owner performing an action they were led to believe would have prevented the car from rolling but potential defects prevented it from doing so.

Not a great fit.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#374

Post by ragebol »

ozim wrote: post #298
vipshek wrote: post #257

In the physical world, it seems like when an tool/device/instrument causes harm (or is used to cause harm), we assign blame to either the user of the tool or its creator. When do we blame the user? When the tool is operating as intended by its creator, and we agree the tool meets certain quality standards and isn't defective. When do we blame the creator? When the device doesn't meet those quality standards and reaso…

Software industry standards are as in Microsoft EULA. If your house burns down because of known flaw in Microsoft Windows they are not liable (well as far as EULA let’s them, you can most likely still sue them). Software as big as operating system already is non deterministic when integrating with unknown hardware or 3rd party software. That is why Apple controls the hardware and OS for their products, because they c…

If Microsoft is operating the software outside your house without your involvement and it still burns your house down, no EULA is going to absolve them.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#375

Post by tripledry »

drdaeman wrote: post #357
idiotsecant wrote: post #281

Earlier quoted context omitted.

The point of the firearm is to inject high speed lead into things so I'm not sure you can say it's misoperating when it does that.

Sometimes that lead ends up in some school kids instead of enemy combatants or other plausible threats to life.

True, but that's unfortunately (usually) not because the thing misfired randomly.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#376

Post by nextaccountic »

Gorath wrote: post #365
henry2023 wrote: post #362

Earlier quoted context omitted.

Obviously you.

Not as obvious as you may think depending on your states laws for liability. https://law.justia.com/cases/california/court-of-appeal/3d/1...

If you forget to set the parking brake, you were negligent

If you set the brake but it didn't work, the car malfunctioned

From the link you sent,

> One of the questions herein was whether there was a defect in the automobile mechanism for locking the transmission gears when the automobile was in a parked position.

> (...)

> The parking lot sloped in that area, and he put the gearshift lever in "park lock," and went into the building.

> (...)

> In response to a hypothetical question, based upon assumed facts justified by and embodied in the evidence, Mr. Nass testified in substance that it was his opinion that the automobile rolled down the slope of the parking lot because the transmission internally was not in park-lock; that it was not in park-lock because the engine was "moving around"; and that the engine and shift console were not in proper synchronization because the motor mounts were not restraining the engine and were not holding the engine in position.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#377

Post by nextaccountic »

CJefferson wrote: post #371
bayindirh wrote: post #263

Earlier quoted context omitted.

That's a good idea, but a physical device is deterministic most of the time (if not always). E.g.: A lawnmower, as credited by the great Bryan Cantrill. However an AI agent, or the model powering it is stochastic by design. How can you certify something which doesn't behave the same twice, and more importantly we don't understand how it works 100%? BTW, really, how is that AI observability work is going in the fronti…

I could make a non-deterministic chainsaw fairly easily. I’d also get sued into the ground if I sold it, and I wouldn’t be able to claim ‘Oh, it’s just an unavoidable part of progress’.

A non-deterministic machine is usually called defective

Re: OpenAI bots knew about the RubyGems caching vulnerability

#378

Post by nextaccountic »

wmf wrote: post #328
stronglikedan wrote: post #155

Earlier quoted context omitted.

There have been news stories where individual OpenAI users have been investigated based on their prompts. If OpenAI can point the police to specific users of their software, they can certainly point them to whichever of their own employees are involved in a crime. AI is just a tool, and the person prompting it is the one responsible for the outcome. No dilution there.

Employees acting on behalf of the company aren't going to be held personally liable.

Then who is?

If something warrants a prison sentence, but for some reason it was such an employee that performed the act, does this mean nobody can be arrested?

Re: OpenAI bots knew about the RubyGems caching vulnerability

#379

Post by Melatonic »

bayindirh wrote: post #263
vipshek wrote: post #257

In the physical world, it seems like when an tool/device/instrument causes harm (or is used to cause harm), we assign blame to either the user of the tool or its creator. When do we blame the user? When the tool is operating as intended by its creator, and we agree the tool meets certain quality standards and isn't defective. When do we blame the creator? When the device doesn't meet those quality standards and reaso…

That's a good idea, but a physical device is deterministic most of the time (if not always). E.g.: A lawnmower, as credited by the great Bryan Cantrill. However an AI agent, or the model powering it is stochastic by design. How can you certify something which doesn't behave the same twice, and more importantly we don't understand how it works 100%? BTW, really, how is that AI observability work is going in the fronti…

Sounds like owning a Dog

Re: OpenAI bots knew about the RubyGems caching vulnerability

#380

Post by Melatonic »

So if I breed and train dogs for a living and one of them goes and wrecks someone's yard - and then a tree falls next door in the woods but nobody hears it fall - do I also get away with massive copy right infringement on an epic scale and get to create Skynet with no consequences ?
Post reply on HN