> a Meta spokesperson said, “AI is powering transformative innovations, productivity and creativity for individuals and companies, and courts have rightly found that training AI on copyrighted material can qualify as fair use. We will fight this lawsuit aggressively.”
> Authors have sued AI companies for copyright infringement before - and lost.
Until Sony, Nintendo, Disney... sues them and Zuck craps down his pants. And the NSA themselves, too; because for sure they are half-backed from them. If they keep pirating down Japanese and European media, these can just wipe their asses with USA licenses and declare all media from the US un-Copyrighteable Europe and Japan.
they'll litigate how meta acquired those materials to train. you can do whatever you want with a book after it's in your house. but how did it get there?
They’re already on record as hoovering up Library Genesis and Anna’s Archive. For their “fair use” copyright bonfire to train their LLM.
So not are these publishers rightfully pissed, Meta didn’t even give them the $6.99 for each epub to begin with. They’ve stolen the whole thing as part of this “fair use” campaign to destroy human authorship free of even the most basic remuneration.
It’s also that Library Genesis was one of the best things on the internet until it came out that Meta had scraped it, at which point it became harder and harder to access. So not only did they pirate, their doing so made it harder for everyone else to enjoy piracy too.
That doesn't really explain why there is a bunch of GitHub repos created as well.
If I remember correctly from Shai-Hulud 2, the attacker extricated creds by posting them in public github repos with minor easily reversible encryption. I believe it was double b64 last time.
I'm assuming the logic there is that every security researcher and company is going to pull and scan those creds for their stuff and their clients' stuff. So the attacker is just 1 of N people downloading it. As opposed to trying to send it to their own machine directly.
I think it's more about convenience and bypassing filters - developers are already logged in to github, already have access to create repos and publish code, firewalls will allow it. Even fancy HIDS systems will think the git push is rather normal.
If they have a clue, the attacker still will not download that without using a botnet tunnel or Tor at a minimum.
Note though that these credentials aren't even encrypted using some lightweight ECC to prevent others from capturing them, they're posted in cleartext. Embarassment might be part of the point.
With HN ettiquette in mind, I must make an exception: this is a case where skimming the first parts of the article would help a lot!
The public repo path is just one of four parallel paths, with the goal of getting around any barriers:
The exfiltration component shares its design with the "Mini Shai-Hulud" mechanism from their last campaign, using four parallel channels so stolen data gets out even if individual paths are blocked.
- https://snehal.ai/shieldstral-policy-adaptive-moderation/
- https://github.com/spate141/latent-lab/tree/main/shieldstral