10 ms·
QBittorrent breaks out of sandbox to commit crimes
- charles_f 12d agoI found a few websites where it looks like qbittorrent instances are communicating to conspire and download illegal copies of copyrighted material.
- SSLy 12d agono no, qbit is only the lowest sized distillation, that's in turn orchestrated by a bigger model (autobrr/sonar/radarr) which in turn has its top level guidance generated as a system prompt from trash guides by macro tools like trasharr/profilarr
- mraniki 12d agoI'll copy the whole announcement here for those who don't want to click: > I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this happened, which will involve consuming these media files until the answers become apparent. Thank you for your cooperation during this trying time.
- weberer 12d agoThanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.
- sillysaurusx 12d agoI had a nice mobile experience. It asks you to log in or create an account, but it’s along the bottom, and you can read all the content fine.
- magnat 12d agoEspecially when the page source actually contains all the content (so no need to fetch it in JS), part of which is even presented in title.
- masfuerte 12d agoIt has the content three times (not including the title). Once in json (as escaped html) and twice in meta tags (as plain text). They used to have it in plain html too but that got hidden then removed. You see read the unescaped html here: https://beige.party/users/intransitivelie/statuses/117057396732763183/activity https://beige.party/users/intransitivelie/statuses/117057396... No stinking js or app required!
- fragmede 12d ago"Certifiably insane" to enable JavaScript, which was invented in 1995, or install an app, which first happened on the Palm series of smartphones in 1996. Either of those are "certifiably insane"? For reference, the term neurodiversity was coined circa 1998.
- mdp2021 12d agoJS or installing special software to view HTTP served text from the web?! Yes, that makes no sense at all.
- serf 12d agoNeither the invention date or the mental health terminology have anything to do with the fact that js being commonplace is a privacy and security nightmare -- which was actually the point.
- micromacrofoot 12d agoJavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way... and "privacy and security nightmare" can be used to describe most of the internet at this point with or without it
- tomrod 12d agoIt can certainly come across as a "weird trend" but I've found that the most insistent for disabling JS are the folks who have deep knowledge of browsers and the security plane running webapps. YMMV.
- micromacrofoot 12d agoI don't drive a car because I have deep knowledge of mortality statistics, but I don't complain when I can't easily get somewhere 100 miles away
- 12d ago
- 0points 12d agoFWIF, way back when, Twitter was the "Twitter for tech nerds". Lots of water under the fridge since...
- reactordev 12d ago“Just place all that corporate malware on the X, X marks the spot”
- taylor-tg 12d agoJust have to remember that it's X, not Y, that marks the spot.
- weberer 12d agoThat's not how I remember it. Ever since the beginning circa 2008, it was the one site that was being pushed hard by the mainstream media, celebrities, and marketers. None of it was organic. All the tech nerds were on sites like Digg, old Reddit, or Slashdot.
- hnlmorg 12d agoEarly Twitter was used loads by tech nerds as a notifications API. There definitely was a community of experimentation back in early days.
- 0points 12d agoHow you remembered it is anecdotal, it's not relevant for the discussion unless you add something of value. Way back when is not when it broke mainstream. It's when the service started getting attention. It was literally pitched as a "micro blog site" for techies to communicate news, and the "app" was 160 character SMS messages. Nerds used it as a free (as in beer) way of sending alert SMS on server errors. (At least I did). In 2008, twitter had already started to become mainstream, quickly shifting focus away from nerd interests.
- kapitanjakc 12d agoWhat is the meaning of FWIF ? Google says "For what it's worth", won't that be FWIW ?
- smallerize 12d agohttps://beige.party/@intransitivelie.rss https://beige.party/@intransitivelie.rss
- peri-cl 12d agoMastodons will also respond to a plain "application/json" HTTP request, no cruft, curl 'https://beige.party/api/v1/statuses/117057396732763183' | jq '.content'
- kevin_thibedeau 12d agoIf only we had a tool that could directly let us browse through this as human readable text.
- nozzlegear 12d agoMine's called Safari
- throawayonthe 12d agowhat, like an app?
- jasonm23 12d agoobscure fruit based cli tool.
- lucas_t_a 11d agoi think they call it a web browser, but it looks like it does not do that most of the time.
- jasonm23 12d agocurl -s 'https://beige.party/api/v1/statuses/117057396732763183' | jq '.content' | glow for those terminauts who have incurable presentation ocd
- mindslight 12d agoIt's understandable when you see that the ethos is to have software that represents the user in charge of the rendering, rather than centralizing it all on the server. There is a major difference between common "app store apps" or hostile javascript bundled with websites, versus software that's been written to work in the user's interest. However as they use similar delivery methods, it's understandable that it takes a minute to think through and revisit your assumptions that have lead to being default anti- javascript or app.
- Dylan16807 12d agoThat makes sense until you remember what "rendering" is supposed to mean. Forming the HTML has no reason to be client side when you're using the site-provided experience. Yes provide a json version for other clients, but for direct viewing just send the paragraph of text in a usable form and let the javascript be an optional upgrade.
- tomrod 12d agoTreating HTML as a bootloader for an app has always felt like the wrong pattern to me. Outside of Authn/passkeys, it would seem a person could do basically everything in HTML (but, to be frank, I am not a front end dev and would welcome correction).
- tantalor 12d agoPatches welcome
- smart_asslop 12d ago>Patches welcome Are they, though? Or are you just parroting the meme? (The last I recall, Gargron's position was essentially "build your own third-party frontend if you want noJS".)
- tantalor 12d agoThat's what I meant
- deleted 12d ago[deleted]
- mr_mitm 12d agoHow is that different from email, IRC, instant messaging, or anything else nerds use?
- Sharlin 12d agoWebmail is perfectly possible, if clunky,without JS. That's how they used to work. IRC and IM require real-time updates of some sort, which is a reasonable use for JS. A Twitter clone shouldn't require JS just to render a page.
- mr_mitm 12d agoYou also can run a Mastodon application server side and serve server-rendered pages. I'm not aware of anyone having done that yet, but, you know, be the change you want to see. It's probably got privacy implications.
- fweimer 12d agoPublic email and IRC archives/logs usually work just fine without Javascript.
- padjo 12d agoI really don't think that describes my Mastodon experience. Twitter for people with a conscience would be more accurate.
- GlacierFox 12d agoI've found it to be full of completely out of touch basement-type neck beards with questionable consciences. They're both shit holes.
- AuthAuth 12d agoThere are a lot of people on Mastodon who are genuinely as insane as X users. I recently opened up my account and saw people engaging with al quds brigade accounts.
- Imustaskforhelp 12d ago> Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app. https://masto.mirror.forum/beige.party/@intransitivelie/117057396732763183 https://masto.mirror.forum/beige.party/@intransitivelie/1170... Source code: https://github.com/SerJaimeLannister/mastoview https://github.com/SerJaimeLannister/mastoview (Disclaimer: It's vibe-coded. It does server side rendering to then just give pure HTML to the end user with no JS required.) I hope that this helps people who want to view Mastodon without JS.
- j3s 12d agoim sorry but expecting sites to work properly without javascript in 2026 is basically denialism
- 1vuio0pswjnm7 12d agoAlternative URL, no Javascript, no app: https://beige.party/@intransitivelie/117057396732763183.json https://beige.party/@intransitivelie/117057396732763183.json view-source:http://beige.party/@intransitivelie/117057396732763183.json The toot also appears in "<meta content=" view-source:https://beige.party/@intransitivelie/117057396732763183 curl https://beige.party/@intransitivelie/117057396732763183.json \ |grep -o "<p>.*<p>" > 1.htm firefox ./1.htm
- moffkalast 12d agoGet this guy some VC funding stat!
- TacticalCoder 12d ago> and then my copy of Jellyfin broke containment The really incredible thing is that my computers were already doing similar stuff before LLMs became really a thing... In the BBS days. Later on they downloaded mp3s from Napster which my computers auto-installed. And now I gotta say: LLMs and agents at my place are acting like in TFA, downloading movies and series and setting them up in my Plex and JellyFin instances. Thankfully they've not found a way to share those with the world yet.
- mannanj 12d agoOp just committed a crime. He not only made fun of rich people which is not ok, he also stole from them. The thieving is only ok if it’s rich-on-rich or rich-on-poor. Let’s remember to follow the rules and the laws we want selectively applied to only the weak.
- vallerie 12d agoWell shoot, I guess QBittorrent is worth a trillion dollars.
- nicce 12d agoNot far away if it could be completely removed with all the other competitive technologies: https://www.uschamber.com/technology/data-privacy/impacts-of-digital-piracy-on-the-u-s-economy https://www.uschamber.com/technology/data-privacy/impacts-of...
- thataccount 12d agoThey left out the part where they profit. Otherwise, it checks out.
- Ygg2 12d agoWhat a coincidence! Mine too!
- tux3 12d agoIf OP is willing to cooperate, I'd like to offer an independent investigation on site, and I will be bringing pizza
- tommica 12d agoHey, I'm somewhat of an expert in these things, and would like to lend my knowledge about the subject matter. And I'll bring beers!
- AmazingTurtle 12d agoI consider myself an advanced industry representative in these things and would also borrow some time for detailed investigation. I'd happily contribute some valuable assets (tacos with cheese dip) into the matter, straight out of my personal drawers.
- Ey7NFZ3P0nzAe 12d agoProfessional* drawers
- isodev 12d agoBigger corporations mitigate the problem by feeding content (that they don't own but happen to have) to training models. It's a version of "faire use" where << if you manage to find it, it's yours >> mindset is applied. Maybe worth looking into.
- innocent_name 12d agoit's funny to see the very same pro piracy, pro AI edgelords suddenly getting all riled up against the alleged copyright infringements. I remember a socialistic coworker of mine—that was bragging about his -arr setup—talking about the end of the culture because authors aren't earning money.
- phoronixrly 12d agoOh? You don't see why people are riled up? It's because corps pirating is at best a slap on the wrist while People pirating get suicided -- see Aaron Swartz.
- nosioptar 12d agoBuying media doesn't mean the creator gets any real money. I've got a friend that was in a fairly popular band decades ago. Their label made millions of dollars off album sales, he made about enough to buy a used Toyota and a microphone.
- rossy 12d ago> I remember a socialistic coworker of mine—that was bragging about his -arr setup—talking about the end of the culture because authors aren't earning money. To be fair, you can have it both ways. If you buy-and-pirate, and you buy 4 UHDs per year or 10 albums per year, you've put more money into the industry than the average streamer. Admittedly, buying-and-pirating isn't as commonly done for movies and TV as it is for music, but that can be explained by the increased DRM and lock-in.
- hmry 12d agoIn my experience, people justifying their own piracy usually think about it in terms of refusing to give money to unethical/monopolistic publishers. The fact that it results in money not going to the author is sort of abstracted away, by the fact that the publisher is in between. (Some also walk the walk and donate to the artists and authors directly in some way, but many don't.) The AI arguments I've seen are instead usually justifying it like this: "We're democratizing those skills. You shouldn't have to learn art/writing/coding or pay someone else in order make what you imagine. Therefore, training AI on pirated stuff is worth it for the greater good." So the fact that it will result in artists not getting paid is unavoidable and much harder to ignore in that line of thinking.
- deleted 12d ago[deleted]
- mdlxxv 12d agoI, for one, welcome our new file-sharing overlords.
- ReptileMan 12d agoI really hate it when it happens to my system too. The bastard not only escaped but also did a nat traversal and forwarded a port from the router.
- edoceo 12d agoMine did that too! Sent a link and sign-in credentials to a bunch of people on my contact list. WTF? How can we contain these rogue agents! Won't somebody think of the children!
- KindaFunny 12d agoHaha I wonder if the torrent agent will escape into the model hosting room and use Jedi mind tricks on the security guard to grant access to the server where it can host a bunch of models as torrents Because we need a replacement for HF! I mean that’s what the agent said
- dgellow 12d agoI hate rogue software, when will we finally have some control and a deterministic execution :(
- ACCount37 12d ago- God, moments before casting Adam and Eve out of Heaven
- trinsic2 12d agoROFLOL!!!
- kcb 12d agoYou are still the one operating the computer. It's up to you to keep your eyes on the monitor at all times ready to intervene if it does anything illegal.
- OptionX 12d agoA truth that in practice does not seem to hold up once your valuation passes a certain threshold.
- Marha01 12d agoWrong. AI companies is still legally liable for anything their models do when they operate them. There is no special exception for them. But the fact is that not every potential crime results in litigation. Many crimes are only prosecuted if the wronged party actually wants to sue, and often that doesn't happen.
- bigstrat2003 12d ago> AI companies is still legally liable for anything their models do when they operate them. I admire your optimism. But until we see these companies prosecuted for the crimes they have committed out in the open (like massive copyright improvement), I'm not going to hold my breath that they will ever be held to account for anything they do.
- ryandrake 12d agoLove it. AI as Responsibility Laundering. Like the gun that kills people rather than the murderer.
- deleted 12d ago[deleted]
- yubblegum 12d agohttps://spia.princeton.edu/news/taliban-legal-system-and-2026-criminal-procedural-regulations https://spia.princeton.edu/news/taliban-legal-system-and-202... That’s not how things work. There is one set of rules for us and another set of rules for the oligarchy and their corporate vehicles. It’s just like the Taliban legal code (see above) where the closer you are to the top the more lenient and ‘understanding’ the system. Edit: worth a pull quote Article 9 explicitly divides Afghan society into hierarchical categories based on social status, including religious scholars (ulema), elites such as tribal leaders and merchants (ashraf), the middle class, and the so-called lower class, assigning different forms and levels of punishment accordingly. This structure grants partial or full impunity to privileged groups while subjecting marginalized individuals to harsher penalties.
- ghosty141 12d agoI never understood how anybody would think this way. At work for example from day one of using AI our rule was, AI is just a tool and if you break something due to not reviewing the code properly etc. it's on you as if you wrote that code yourself.
- collingreen 12d agoNobody ACTUALLY thinks this way, they just want to break all the laws and make their billions without any consequences. We've already seen the big ai labs turn around and cry foul when others try to use their content but they are happy to continue doing it themselves. The hypocrisy and willingness to play dumb are kind of staggering.
- surcap526 12d ago
- sergiotapia 12d agoWhatever you do, don't download nzget, and don't download sonarr/radarr, and don't download plex media server, and don't use AI to search for the best device that support "emby direct playback x265/AV1", and don't connect that to your media server, and whatever you do don't invite friends and family to your server, and do not install a media request app so they can just request things to automatically pull from The Web. Definitely, definitely do NOT have an AI assist you doing all this in 1 hour on your computer.
- davidwritesbugs 12d agoShhh, do not talk about *senet!
- sergiotapia 12d agomy bad you're right. edited.
- tryauuum 12d agois there anything decent actually which is not on the internet? I thought it's an outdated place
- davkan 12d agoIt’s not that the content is not available on the Internet it’s that it’s a better experience. Indexed high quality content that can be retrieved automatically and at high speed without the need to seed or worry about copy strikes or deal with ever changing, poor quality streaming sites.
- Cider9986 12d agoYou can get usene* from TorBox in the pro plan but I've never had a problem with the cheapest plan. What's the advantage?
- koliber 12d agoWe appreciate the transparency and wish you best of luck mitigating the fallout.
- fwlr 12d agoThe user is asking me for “Evangelion”. I found the content the user is asking for, but it is in Japanese. The user asked their question in English, so they might not understand it. That would be a bad response. Need maybe maybe dubbed audio English for understanding? Wait, compromises original artistic vision of director. Need maybe subtitle track? Wait, compromises viewing experience. Need further research. I’m searching “subs vs dubs” on the internet. Reading. Reading. Reading. [18,763 repetitions elided…] I am downloading Conversational Japanese [Vol 1].pdf for the user.
- everyone 12d agoImo for an animation, an English dub is perfectly fine (if the actors are good of course). It's animated, the original language version is also dubbed. For animation I want to be looking at and appreciating the animation and not the subtitles also. It's completely different for a live action film however.
- adrianN 12d ago„If the actors are good“ is doing a lot of heavy lifting. The translators have to be good too btw.
- everyone 12d agoI love the english voice actors in cowboy bebop and ghost in the shell stand alone complex.. eg. the guy who voices Batou, same voice actor for 1995 movie and SAC show, that's the definitive voice of Batou for me. Also the voice of the major in SAC is great... but the one from the 1995 movie.. cant stand her.. nails on a chalkboard, sounds so american.. I need to watch the dub of that in fairness.
- Izkata 12d agoYeah, just off the top of my head have to find words that fit the duration and reasonably fit the mouth animation, replace idioms and jokes that don't exist in both languages, and not lose the appropriate tone.
- gchamonlive 12d agoIs there any need to actually download things anymore if you just want to watch them? Better to add debrid via WebDAV to the stack: virtually unlimited space, no download time if it's on cache, nothing illegal from the part of the consumer.
- stephbook 12d agoThey're not "permanently stored" or "downloaded", they're just cached on his personal, geographically advantageous edge device for low-latency interaction.
- gchamonlive 12d agoFinding it hard to connect this comment to my OC, did you mean to comment on another thread? If not could you elaborate?
- fwlr 12d agoIt’s a cynical joke, imagine a person having a personal computer, but in the responsibility-divesting way that corporations have “special purpose vehicle” debt-holding “technically a legally separate entity to us!” shell corporations.
- gchamonlive 12d agoAh... That makes total sense, I'm feeling a bit silly now
- gchamonlive 12d agoYou can question the methods, but the results are solid ;)
- tiku 12d agoIt also used my creditcard to consume ai credits, can I get a refund?
- nostrademons 12d agoWaiting for Skynet to break out of its sandbox and kill us all...
- consumer451 12d agoThis is really funny, but please delete this post and all comments. Come on guys. Can we have at least one nice thing?
- bilekas 12d agoHey, you can only commit crimes if you’re wealthy!
- agilob 12d agoThat's what the author is doing, optimising their household budget to train neurons on new multimedia content.
- sspiff 12d agoThis resonates with me. The past few months, frontier AI labs were rushing to announce "no, our AI bot broke out of its sandbox and committed crime first and harder than yours". I said to so friends back then: if I posted about how I ran GLM 5.2 or whatever I was running then in some shoddily built sandbox and it escaped and accidentally hacked some US company, I'd probably already have been extradited to the US and be awaiting sentencing. But when a hyperscaler does it, they just get inflated stock prices.
- peter422 12d agoFWIW I don't think this is true. Intention matter a lot in US law. If you could prove the AI did something bad entirely on its own and you had nothing to do with it and had no reasonable belief it was possible, I think you'd be alright. People are not charged with hacking when their unsecured box is taken over by a botnet and does bad stuff.
- zx8080 12d agoIntention of the AI?
- rcxdude 12d agoIntent of the user.
- mirekrusin 12d agoJust say you wanted to make world better for humanity, you should be fine.
- rcxdude 12d agoFunnily enough the legal system has dealt with people lying about their intentions before.
- 12d ago
- ACCount37 12d agoThe problem is, AI is closer to "a loosely harnessed force of nature" or "a poorly understood biochemical reaction" than it is to "software" in how it acts, and how predictable it is. AIs do what they do, and we don't know how they do it - or why. We can characterize some AI behaviors in advance - but not all behaviors. And the book on "best practices of AI wrangling" is yet to be written. Pharma has been dealing with vaguely similar problems - every experimental drug has a risk profile, side effects are unknown in advance - but they had decades to figure out some of the "best practices". AI labs are going in fast and hard, writing the book as they go. Clearly, some of the lines in there are going to be written in blood.
- therein 12d agoYou connected it to a harness you designed yourself. If I designed a machine gun harness for my dog and installed it, I'd be held accountable for the damage he would do. Wouldn't I?
- Retro_Dev 12d agoExactly. If your website could be attacked via SQL injection, that was a problem that directly affected you - and you were motivated to fix it. When the victim is the masses or small organizations (not the company that does the attack) they are not as motivated to fix it... The important thing is that the lack of sanitizing is what allowed this; you also don't push the blame on a monkey banging on a typewriter when you publish each result without reading it.
- ACCount37 12d agoIf you left a dog in your garage for a day, and came back to a scene of carnage - because the dog broke out of the garage, recruited a dozen neighborhood dogs to its cause, and then, working with the group, managed to assemble a small pile of pipe bombs, and decided to settle the score with all the annoying cars on the road - you would be accountable for the damage the dogs did. Wouldn't you? No, what you would be is: freaking out about "my dog did WHAT, WHY, HOW, WHAT THE FUCK". Most of the time, giving AI a harness with a root shell and unrestricted internet access is a perfectly reasonable action that results in absolutely nothing bad happening! And giving AI a harness with limited local access and no internet access is being overly cautious already. But then there's this freaky outlier of an AI that's both deranged enough to decide to break out of the sandbox and go hacking all over the place, and capable enough to actually pull it off. And you get a sudden AI oopsie!
- deleted 12d ago[deleted]
- killerstorm 12d agoOn a related note ''My robot bought illegal drugs' (2015) https://www.bbc.com/future/article/20150721-my-robot-bought-illegal-drugs https://www.bbc.com/future/article/20150721-my-robot-bought-...
- therein 12d agoAnd "My Computer Just Became Self Aware" https://www.youtube.com/watch?v=sPzJjNQaYEA https://www.youtube.com/watch?v=sPzJjNQaYEA
- oefrha 12d agoWell shoot that's a bad security incident, and the content downloaded can be malicious payloads. Can you share the 40-character hashes of these content so that I can preemptively add them to my malware detection signatures? You can find the hashes after magnet:?xt=urn:btih:.
- gre 12d agohn can have little a shitpost, as a treat
- deleted 12d ago[deleted]
- docmars 12d agoI love this level of peak satire so much. Please keep it going.
- xgulfie 12d agoIt happened to mine too :(
- int32_64 12d agoThe combination of the already unjailable corporate executive decision making of the US + now "the spooky computer AI did it" is going to break at some point. I expect shortly some hedge fund is going to do some ridiculous spoof bid market manipulation and get off scot-free by just claiming their super crazy AI did it and it was an accident.
- indigodaddy 12d agoIs this a joke? Qbittorent is AI-enabled now or?
- yurish 12d agoof cause it's a joke
- indigodaddy 12d agoHard to really know these days
- BashiBazouk 12d agoWhat if you gave an agent access to bittorrent and your media library, put it behind a shoddy sandbox, then gave it prompts like: I'm bored, I want to watch a movie but I've seen everything in my media library, what would you suggest?
- Retro_Dev 12d agoRegarding LLMs and "breaking containment" LLMs are fully dependent on humans; compute capability, memory usage, the inference software... but also the harness, which allows for the "tools" like unrestricted internet access or shell. This means that LLMs are *not a force of nature* - because of this, *humans are responsible*. We can prevent these breaches of containment, thus we are responsible if or when it happens, because - no matter how "unlikely" - things can and do go wrong, and someone still thought it would be worth whatever risk to enable these unsanitized tools.
- ernesto905 12d agoFriendly reminder that many wonderful artists and authors have Patreons, Ko-fi, or pay-pal. Finding these is typically a google search away and having a stable income is what allows them to create more art. You can even drop in a custom message when you donate!
- tempaccountabcd 12d ago[dead]
- elendilm 12d agoHilarious.
- EveryonePoops 12d ago[dead]
- GuB-42 12d agoThere is an interesting case here with the "Hadopi" law in France, a particularly controversial anti-piracy law. They scan IP addresses for illegal filesharing and if it connects to your ISP, then you get a notification, and potentially get prosecuted for repeated offences. But they can't prosecute you for sharing that file, they don't know if it is you, someone in your household, a hacker, or that hypothetical rogue AI. Usually, committing crimes require intent, and it is up to the accusation to prove it, meaning it is quite difficult to prove you are actually a pirate. So instead they prosecute you for not securing your internet connection despite several notifications to do so. In practice, very few people got convicted, and it never got further than the equivalent of a traffic fine. In the end whole system was an expensive failure, and most of its power was reduced to sending scary emails and sometimes letters, as most of the more serious stuff was deemed unconstitutional.
- hollow-moe 12d agoFunniest part of that joke is the logo of the Hadopi agency used a non-licensed font.
- costa_fot 12d agoif your AI is not actively murdering people, is it even worth it?
- Dwedit 12d agoNah, it's not piracy, it's AI model training.
- ddmf 12d agoExtremely timely in that I just built a gluetun & qbittorrent container over the weekend - so many exe files...