QBittorrent breaks out of sandbox to commit crimes

(beige.party)

386 points | by mraniki 3 hours ago

24 comments

  • mraniki 3 hours ago
    I'll copy the whole announcement here for those who don't want to click:

    > I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this happened, which will involve consuming these media files until the answers become apparent. Thank you for your cooperation during this trying time.

    • weberer 1 hour ago
      Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.
      • peri-cl 11 minutes ago
        Mastodons will also respond to a plain "application/json" HTTP request, no cruft,

            curl 'https://beige.party/api/v1/statuses/117057396732763183' | jq '.content'
      • magnat 42 minutes ago
        Especially when the page source actually contains all the content (so no need to fetch it in JS), part of which is even presented in title.
      • smallerize 40 minutes ago
      • tomrod 9 minutes ago
        Treating HTML as a bootloader for an app has always felt like the wrong pattern to me. Outside of Authn/passkeys, it would seem a person could do basically everything in HTML (but, to be frank, I am not a front end dev and would welcome correction).
      • sillysaurusx 57 minutes ago
        I had a nice mobile experience. It asks you to log in or create an account, but it’s along the bottom, and you can read all the content fine.
      • 0points 47 minutes ago
        FWIF, way back when, Twitter was the "Twitter for tech nerds".

        Lots of water under the fridge since...

        • weberer 13 minutes ago
          That's not how I remember it. Ever since the beginning circa 2008, it was the one site that was being pushed hard by the mainstream media, celebrities, and marketers. None of it was organic. All the tech nerds were on sites like Digg, old Reddit, or Slashdot.
        • reactordev 26 minutes ago
          “Just place all that corporate malware on the X, X marks the spot”
      • mindslight 11 minutes ago
        It's understandable when you see that the ethos is to have software that represents the user in charge of the rendering, rather than centralizing it all on the server. There is a major difference between common "app store apps" or hostile javascript bundled with websites, versus software that's been written to work in the user's interest. However as they use similar delivery methods, it's understandable that it takes a minute to think through and revisit your assumptions that have lead to being default anti- javascript or app.
      • fragmede 49 minutes ago
        "Certifiably insane" to enable JavaScript, which was invented in 1995, or install an app, which first happened on the Palm series of smartphones in 1996. Either of those are "certifiably insane"?

        For reference, the term neurodiversity was coined circa 1998.

        • serf 36 minutes ago
          Neither the invention date or the mental health terminology have anything to do with the fact that js being commonplace is a privacy and security nightmare -- which was actually the point.
          • micromacrofoot 10 minutes ago
            JavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way... and "privacy and security nightmare" can be used to describe most of the internet at this point with or without it
            • tomrod 7 minutes ago
              It can certainly come across as a "weird trend" but I've found that the most insistent for disabling JS are the folks who have deep knowledge of browsers and the security plane running webapps. YMMV.
              • micromacrofoot 4 minutes ago
                I don't drive a car because I have deep knowledge of mortality statistics, but I don't complain when I can't easily get somewhere 100 miles away
            • swiftcoder 5 minutes ago
              > JavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way

              I'm not aware of any other language that is layered on top of a perfectly serviceable user-facing content delivery syntax?

    • moffkalast 45 minutes ago
      Get this guy some VC funding stat!
    • TacticalCoder 18 minutes ago
      > and then my copy of Jellyfin broke containment

      The really incredible thing is that my computers were already doing similar stuff before LLMs became really a thing... In the BBS days.

      Later on they downloaded mp3s from Napster which my computers auto-installed.

      And now I gotta say: LLMs and agents at my place are acting like in TFA, downloading movies and series and setting them up in my Plex and JellyFin instances.

      Thankfully they've not found a way to share those with the world yet.

  • ryandrake 49 minutes ago
    Love it. AI as Responsibility Laundering. Like the gun that kills people rather than the murderer.
    • aleph_minus_one 6 minutes ago
      > Like the gun that kills people rather than the murderer.

      Relevant:

      > Guns don't kill people, I kill people - with guns

      > https://www.youtube.com/watch?v=xC03hmS1Brk

      :-D

    • throw93839394 7 minutes ago
      More like dogs. Combat dogs, banned in most countries, with breed name like "literal bull killer" are considered safe. Bonus is no-kill shelters move violent dogs across state border, to clear their bite history, and advertise them as "cute family pets" for adoption.

      Zero responsibility! Zero punishment!

      • crm-114 2 minutes ago
        Where did the dog touch you?
    • ghosty141 19 minutes ago
      I never understood how anybody would think this way. At work for example from day one of using AI our rule was, AI is just a tool and if you break something due to not reviewing the code properly etc. it's on you as if you wrote that code yourself.
      • amelius 0 minutes ago
        But if you are in a full selfdriving car and it kills someone, is it on the user, or on the vendor of the car?
      • ryandrake 8 minutes ago
        Well, responsibility laundering isn't exactly new. People use corporations to diffuse responsibility and avoid punishment for crimes all the time. "The corporation did it, not the decision makers in the corporation!"
      • collingreen 10 minutes ago
        Nobody ACTUALLY thinks this way, they just want to break all the laws and make their billions without any consequences. We've already seen the big ai labs turn around and cry foul when others try to use their content but they are happy to continue doing it themselves.

        The hypocrisy and willingness to play dumb are kind of staggering.

      • gdulli 7 minutes ago
        You're an employee. This use case is for people much richer than you.
      • adrianN 1 minute ago
        The efficiency of responsibility laundering depends on your social standing. If people like you they welcome reasons not to prosecute you, if you are disliked people might go as far as to start prosecuting you for made up reasons.
    • yubblegum 32 minutes ago
      https://spia.princeton.edu/news/taliban-legal-system-and-202...

      That’s not how things work. There is one set of rules for us and another set of rules for the oligarchy and their corporate vehicles. It’s just like the Taliban legal code (see above) where the closer you are to the top the more lenient and ‘understanding’ the system.

      Edit: worth a pull quote

      Article 9 explicitly divides Afghan society into hierarchical categories based on social status, including religious scholars (ulema), elites such as tribal leaders and merchants (ashraf), the middle class, and the so-called lower class, assigning different forms and levels of punishment accordingly. This structure grants partial or full impunity to privileged groups while subjecting marginalized individuals to harsher penalties.

  • tux3 1 hour ago
    If OP is willing to cooperate, I'd like to offer an independent investigation on site, and I will be bringing pizza
    • tommica 22 minutes ago
      Hey, I'm somewhat of an expert in these things, and would like to lend my knowledge about the subject matter. And I'll bring beers!
  • vallerie 1 hour ago
    Well shoot, I guess QBittorrent is worth a trillion dollars.
  • bilekas 5 minutes ago
    Hey, you can only commit crimes if you’re wealthy!
  • gchamonlive 12 minutes ago
    Is there any need to actually download things anymore if you just want to watch them? Better to add debrid via WebDAV to the stack: virtually unlimited space, no download time if it's on cache, nothing illegal from the part of the consumer.
  • consumer451 10 minutes ago
    This is really funny, but please delete this post and all comments. Come on guys. Can we have at least one nice thing?
  • isodev 1 hour ago
    Bigger corporations mitigate the problem by feeding content (that they don't own but happen to have) to training models. It's a version of "faire use" where << if you manage to find it, it's yours >> mindset is applied. Maybe worth looking into.
  • fwlr 21 minutes ago
    The user is asking me for “Evangelion”. I found the content the user is asking for, but it is in Japanese. The user asked their question in English, so they might not understand it. That would be a bad response. Need maybe maybe dubbed audio English for understanding? Wait, compromises original artistic vision of director. Need maybe subtitle track? Wait, compromises viewing experience. Need further research. I’m searching “subs vs dubs” on the internet. Reading. Reading. Reading. [18,763 repetitions elided…] I am downloading Conversational Japanese [Vol 1].pdf for the user.
    • everyone 18 minutes ago
      Imo for an animation, an English dub is perfectly fine (if the actors are good of course). It's animated, the original language version is also dubbed.

      For animation I want to be looking at and appreciating the animation and not the subtitles also.

      It's completely different for a live action film however.

  • charles_f 35 minutes ago
    I found a few websites where it looks like qbittorrent instances are communicating to conspire and download illegal copies of copyrighted material.
  • koliber 23 minutes ago
    We appreciate the transparency and wish you best of luck mitigating the fallout.
  • tiku 12 minutes ago
    It also used my creditcard to consume ai credits, can I get a refund?
  • nostrademons 12 minutes ago
    Waiting for Skynet to break out of its sandbox and kill us all...
  • Ygg2 1 hour ago
    What a coincidence! Mine too!
  • dgellow 58 minutes ago
    I hate rogue software, when will we finally have some control and a deterministic execution :(
  • thataccount 3 hours ago
    They left out the part where they profit. Otherwise, it checks out.
  • KindaFunny 1 hour ago
    Haha I wonder if the torrent agent will escape into the model hosting room and use Jedi mind tricks on the security guard to grant access to the server where it can host a bunch of models as torrents

    Because we need a replacement for HF!

    I mean that’s what the agent said

  • sergiotapia 44 minutes ago
    Whatever you do, don't download nzget, and don't download sonarr/radarr, and don't download plex media server, and don't use AI to search for the best device that support "emby direct playback x265/AV1", and don't connect that to your media server, and whatever you do don't invite friends and family to your server, and do not install a media request app so they can just request things to automatically pull from The Web.

    Definitely, definitely do NOT have an AI assist you doing all this in 1 hour on your computer.

  • mdlxxv 1 hour ago
    I, for one, welcome our new file-sharing overlords.
  • ReptileMan 1 hour ago
    I really hate it when it happens to my system too. The bastard not only escaped but also did a nat traversal and forwarded a port from the router.
    • edoceo 25 minutes ago
      Mine did that too! Sent a link and sign-in credentials to a bunch of people on my contact list. WTF? How can we contain these rogue agents! Won't somebody think of the children!
  • trinsic2 53 minutes ago
    ROFLOL!!!
  • innocent_name 1 hour ago
    it's funny to see the very same pro piracy, pro AI edgelords suddenly getting all riled up against the alleged copyright infringements. I remember a socialistic coworker of mine—that was bragging about his -arr setup—talking about the end of the culture because authors aren't earning money.
    • nosioptar 52 minutes ago
      Buying media doesn't mean the creator gets any real money. I've got a friend that was in a fairly popular band decades ago. Their label made millions of dollars off album sales, he made about enough to buy a used Toyota and a microphone.
    • hmry 32 minutes ago
      From what I have experienced, people justifying their own piracy usually think about it in terms of refusing to give unethical/monopolistic publishers money. The fact that it results in money not going to the author is sort of abstracted away, by the fact that the publisher is in between. (Some also walk the walk and donate to the artists and authors directly in some way, but many don't.)

      The AI arguments I've seen are instead usually justifying it like "We're democratizing those skills. You shouldn't have to learn art/writing/coding or pay someone else in order make what you imagine, and training AI on pirated stuff is worth it for the greater good." So the fact that it will result in artists not getting paid is much harder to ignore and unavoidable in that line of thinking.

    • rossy 47 minutes ago
      > I remember a socialistic coworker of mine—that was bragging about his -arr setup—talking about the end of the culture because authors aren't earning money.

      To be fair, you can have it both ways. If you buy-and-pirate, and you buy 4 UHDs per year or 10 albums per year, you've put more money into the industry than the average streamer. Admittedly, buying-and-pirating isn't as commonly done for movies and TV as it is for music, but that can be explained by the increased DRM and lock-in.

    • phoronixrly 1 hour ago
      Oh? You don't see why people are riled up? It's because corps pirating is at best a slap on the wrist while People pirating get suicided -- see Aaron Swartz.
    • thrance 30 minutes ago
      There are major differences between an individual illegally downloading movies and a major corporation getting their hands on literally all of Human Creation.
    • mmooss 8 minutes ago
      This false (IMHO) equivalency is weapon people like to keep handy these days, ready to shoot at any target.

      There is all the difference in the world between the scenarios. The argument's popularity seems to be born in the argument, more popular on HN, that American white / Christian / males (or some subset of those factors) face discrimination by programs to benefit minorities / women.

      What is the difference? It is power. Punching up or protecting the politically vulnerable is a completely different act than punching down or empowering the already powerful and oppressing the vulnerable. Punching down causes the vulnerable to be oppressed (jailed or otherwise restricted in who, where, what, when, etc they can do and be), impoverished, and killed - by definition, they are vulnerable. The powerful have their power challenged, which is many times appropriate among free people where 'all are created equal' and have the same rights.

      In the case of artistic media - songs, books, etc. - private people downloading art to use it as art are spreading art and empowering themselves at the expense of powerful interest who have seized control of the art. That's much different than powerful people taking the art to increase their own profit and power, and to significantly displace and distort the art.

      (I'm oversimplifying for these purposes: The fact that artists don't get paid by the former, and that it's anarchy used for bad things too, are serious problems.)

      > socialistic

      You're giving away your biases. Only a certain group calls everything they don't like 'socialism'. It's libertarianism or anarchism. Socialists might say, for example, the state should control distribution of media.

  • kcb 52 minutes ago
    You are still the one operating the computer. It's up to you to keep your eyes on the monitor at all times ready to intervene if it does anything illegal.
    • OptionX 49 minutes ago
      A truth that in practice does not seem to hold up once your valuation passes a certain threshold.
      • Marha01 16 minutes ago
        Wrong. AI companies is still legally liable for anything their models do when they operate them. There is no special exception for them. But the fact is that not every potential crime results in litigation. Many crimes are only prosecuted if the wronged party actually wants to sue, and often that doesn't happen.