Scientists say this is the first occurance of the word "model" in the title of a post on HN that does not refer to a neural network of some sort since 2023
Personally, I'd never build on top of Roblox itself, but... and I hate to say this, if they made a generic 3D service that let you export to any game engine, I think I'd pay Roblox for said tool if it was good enough, which, they have so many games and capital, I could see them pulling that off, I mean they already have a base model.
I would love to see more text to 3D model models that can wire up straight to a game engine, I think we'll see a lot of interesting things, like children prompting the worlds of their imagination into reality, and the 50 million memes that will plague social media.
> I would love to see more text to 3D model models that can wire up straight to a game engine
Same, but none of the models actually have good enough output yet to make that work. Currently they're all aiming to "fake" the niceness by doing modeling+texturing, but when you look at the wireframe, it's pretty clear they're very far of from being usable, even less so in a game where performance matters a great deal, and you can't just YOLO assets however you want, which is what the "text to 3D" models like to do.
Inevitable that we'll get there eventually though, it's miles ahead where it was just 1-2 years ago. I guess my point is that it's not the "3D model > game engine" that is lacking at the moment, but "text > 3D model" that cannot produce high quality enough results.
I wonder if the solution is either an intermediary "model spec" that can render into others (this becomes the target for all these model models), or an LLM style hack where its trained on recreating 3D models using code, I know for CAD (I forget which one it is) there's a CAD program where your models / designs can be written in code.
One weird thing I run into is, I can have Claude make some interesting things with threejs, but translating it to other engines isn't always so great, and its usually raw code. I'm not a 3D guy, I just want to get up and running with things I can code / think of.
but I'd prefer to have an industry expert involved, for the accuracy of the model, model to supervise and co-create model trained on models then would generate a model of a model.
As photographer, I find it hard to work with your model. It's like it has no training and just sits there waiting to be told what to do. I spend more time explaining what I want the model to do than actually working with the model. Maybe I should shell out for a professional model instead of working the the open models hoping to be a professional one day.
You laugh, but this is the kind of data that allows you to train models that actually catch a lot of corner cases, as well as generalizing to other 3D applications.
I'm not gonna comment on the morality of mass acquisition of all of this data, but as someone who deals in 3d in the medical/dental space everyday..
there's absolutely no doubt that all of that data is as valuable as gold in research.
On a tangential but related note..
I mean, people in possession of troves of data, especially in the medical or 3D industries, really ought to start understanding the value of the data they're sitting on. You can give it away if you like, but don't be upset when someone turns it into a couple hundred billion dollars and doesn't compensate you.
If you won't like it if tech companies rip you off, then take the legally required steps to protect your data. (That includes making sure you licensed your data properly. And protecting your data with explicit use licenses and, potentially, even access controls.)
If you read the article, you'd find they admit to that, their position is nuanced, and this is not a "gotcha".
> We'll be honest about where we stand. We don't like copyright as it exists. We'd like to see it radically reformed, and we wouldn't mourn it if it were abolished. Our community lives in its grey areas every day: many of the models on our sites are fan ports of characters from commercial games, made out of love and shared for free. When a studio sends us a takedown notice, we comply.
> While we as small artists and fan communities get copyright used against us, the world's largest companies are committing copyright infringement at a scale unseen in human history. This has been the case since the invention of the internet of course; digital media make duplication, remixing and resharing trivial, but copyright law never caught up. Filesharing stabbed copyright in the gut. AI is just twisting the knife, and completes the creation an unequal system where copyright infringement is only a crime if you're a low net worth individual.
Rich companies are infringing copyright at industrial scale in order to build their LLMs, and even if caught and challenged, they don't suffer any catastrophic punishment. The infringed party gets enough money to shut them up and everyone moves on. A fine is a price. They'll keep doing it with impunity. Meanwhile the small guy who doesn't have copyright lawyers on retainer is getting shafted, time and time again.
"When a studio sends us a takedown notice, we comply." Well, yes, obviously they have to, or risk not existing anymore.
Also, "fan ports" is doing a lot of the heavy lifting. They're assets extracted from commercial games, uploaded with whatever license the person who extracted and packaged them chooses.
From their argument, if they truly think copyright should be abolished, an LLM capable of remixing that work into whatever you want would be a good thing, right? Ultimately this would empower the end-users of the models.
There's an argument to be made that these models trained on the world's knowledge shouldn't be locked behind closed models controlled only by big corps, but in this case it's good that anyone can download data and train such a model, right?
I can't speak for roblox intentions, and I am well aware of their history. But so far they seem to have published at least some of their model work to HuggingFace: https://huggingface.co/Roblox/
I've seen my son play Sonic the Hedgehog games in Roblox that were straight rips from the original games (at least visually and play-wise). I'm not really sure how it was done (extracting actual assets from the game, or just a dedicated user very familiar with the original game), but there are quite a few recreations of other games on Roblox that are just as good as the originals.
> Rich companies are infringing copyright at industrial scale in order to build their LLMs, and even if caught and challenged, they don't suffer any catastrophic punishment
And the same thing is happening here? They’re hosting copyrighted materials and have also not suffered catastrophic punishment.
Their infringement is different, and would really be a trademark issue if we hadn’t just invented the idea of copyrighting a character separately from the story they are a part of in the ‘30s (they are not individually copyrightable under the original text).
There’s a substantive difference between ingesting other people’s work and hosting copies of fans knockoff models of their favorite characters.
It’s even weirder because in other mediums this wouldn’t even be a thing. Nobody gets nearly as up in arms about fans doing their own cuts of movies, or re-using characters in written fan fiction, or etc. Very odd to me how up in arms people get about this specifically for visual art.
I think this is an important point we need to grapple with more and more in the future. We like to think an act as either lawful or not lawful, either ethical or not ethical. We need to bring in scale as a separate axis. There's a world of difference whether an activity is done at human scale or machine scale. At human scale, it's an act of deviance that may contribute to the diversity of human experience. At machine scale, it's a distortion that threatens the society.
The internet was built on aggregators and crawlers, it only matters when people are not getting paid... I prefer the internet to be unregulated, but whatever greed always wins
But it is okay if not-rich people do it. I have "pirated" and otherwise flaunted copyright my whole life, along with many millions more. Nobody has ever come at me for it. Enforcement of any sort against common people is exceedingly rare. For a long time it was only corporations who took copyright seriously, and now that even they are flaunting copyright people such as yourself suddenly pretend that the little guy has to care.
Well I don't! Copyright is a farce and I continue to wipe my butt with it.
This thread of comments seems to be getting somewhat off topic. I believe the point being made by open3dlabs is that copyright is basically a pay to play system for corporations which is obviously unjust. You're right that copyright isn't enforced on individuals, but DMCA is definitely enforced on small content sharing sites which have little to no recourse compared to large corporations that can flagrantly break the law.
Exactly. It's like the Clean Air act. Nobody's coming looking for your wood stove but they'll happily pull a million bucks out of some podunk business who's maintenance guys were foolish enough to use up an old case of paint that predates whatever the modern VOC regulations are.
Just because individuals aren't an enforcement target doesn't mean enforcement isn't happening.
Yep, this is basically the outlook of ChatGPT etc in america, when they try and stop china scraping them. I hope they go bust as soon as possible.
Honestly people need to wake up to this industrial level theft, and get some laws in place. If someone did this by hand you'd call it either a DDOS or IP theft, even if license is permissive. Just cos its from a machine doesn't excuse.
I have a question/thought/philosophy. If AES is a relatively strong encryption method right now, _why don't we wait to crack the assets until the encryption method is easy to decrypt_? By the time that's possible, the game assets will likely be old as shit, so it would potentially sit better with everyone. If we wait, it takes on a more archival type feeling.
I understand importance of preservation, but frankly, the English WWW seem to massively and simultaneously overestimate rarity and undervalue financial costs of creative assets like 3D models and 2D images.
It's not rare that these assets cost in ranges of $10k and made in less than dozen man-hours each. They're not harvested and collected, but artificially created by individuals by work orders or as their own projects. A lot of these conversation feels like people are talking about something similar to Louvre collection items that cannot be obtained other than by somewhat illicit means, leading to discussions of which illicit means will be tolerated in the name of preservation.
No, it's something they make as we speak on Blender. Like with a mouse and a keyboard, or sometimes with a pen tablet. I think the anglosphere Internet hasn't yet reached the point where justification of dubious means can be discussed; we're at the phase where it should be educated to people more often that these are man-made creations that each has economic values.
I think you are missing the point here. The art assets in question belong to the studio. Yes, they are painstakingly made. They are made with the assistance of some very very expensive technologies. Full body scans. Facial rigging with 180 high fps cameras. Mocap suits and props in a full blown warehouse studio. The works. It's not just a 3D model. It's a rigged 3d digital twin of an actor. There's image rights, etc that have to be negotiated and deals made. Preservation would be to preserve the data as is rather than reworking it into a blender scene.
My point is about endemic lack of general understanding for these types of arts on English part of the Internet/WWW, no offense to GP intended. It feels like listening to museum curators discussing "oil on canvas" without ever having set foot on a store that have tubes of paints and canvases on the shelf and Apple Pay stickers at the cashier.
Without more widespread recognition about how these models, arts, games, etc., are artificially made by humans, and not magically discovered, I think discussions as to how they should be handled will be always a bit off, whichever way it would go. That's my point.
Without getting into the much debated philosophy of restoration/display of preserved things and how restoration can often cause degradation to the original piece, consider that just preserving the data in the manner you suggest also requires preserving the original software if you ever want to view it. Which requires not just preserving that original software but also all the external hardware and software that original software relies on. Quite often that's a dead end as it requires preserving an activation/license server that the preservers don't have access to.
That isn’t true, you preserve the data as is for the software as is. You can emulate under it if you need to run it. This is what internet archive has done and the proper preservation of the media is in tact. In NO WAY do you ever need to convert the data back to a workable source in its original authoring program.
You are wrong, you are basically saying "black cats exist therefore cats can't be tabby", there are plenty of preservation initiatives that preserve works in different forms when the original media can not be practically preserved or displayed. Yes best practice is to preserve as close to initial state as possible, that does not mean that when you cannot feasibly preserve the work in it's original state (with digital it's often due to drm) that you just say screw it nothing we can do but chuck it in the dustbin of history.
That's like saying bank robbers don't actually shoot guns, only people who use guns legally shoot them. It's still preservation. Or even more apt saying archeologists aren't archeologists they're tomb raiders. They may be tomb raiders but they are still archeologists.
According to the timestamp, that was uploaded less than 24 hours ago.
I'm not familiar with their site; I assume it's user-uploaded? In that case, it's the same challenge that every user-generated content site has, balancing openness with policing IP violations.
their staff posts these things. their staff creates videos of how to rip assets from games. they are fully aware of what their users are doing and they openly encourage it.
Scroll through the site, there are A LOT of assets from games, packaged by users. It's a nice subtrefuge, in practice it is a place to get ripped assets and the platform washes it's hands.
Again, I don't have any particularly strong issue with this, just with the pearl clutching regarding roblox downloading the data.
Game companies generally don't care if you don't make money from your mods or fan projects. And yes technically copyright nowadays lasts until the heat death of the universe but 10 year old games are in commercial limbo.
Ofcourse AI providers very much DO want to make money with their trained models.
Considering you link something that has a non comnercial license CC-by-NC, there might be others with permissive licenses. There might be things in their TOS of the site,
There's more with different licenses. If you scroll through the pages, there are a lot of assets ripped from games, with a variety of licenses CC-by-NC, or just "beerware":
This is the kind of misinformation that spreads around the internet without ever being fact checked.
Theft is the action or crime of stealing. The fact that some definitions include the concept of "with the intent to deprive the original owner of it" doesn't make digital theft not a theft.
Also, it could be argued that the theft of the IP is further substantiated by the loss of future potential revenue from that IP, as, after all, why would anyone pay the orignal owner and creator actual money when an AI agent will make an exact duplicate of said item and possibly further customize it for them as part of its already paid for product catalog?
I mean, it's not misinformation, though it may be incomplete. Taking the us example, in most states the larceny statute—the "crime" of theft, as you put it—does in fact require an intent to permanently deprive. Unlawful copying is not larceny or theft and no da could prosecutor could prosecute it under a larceny statute. It may of course be copyright infringement, which some people rhetorically analogize to theft. That analogy may be useful for some purposes, including for motivating normative intuitions. But it's categorically different as a matter of law.
Just remember, the morals of someone making an argument have no bearing on whether an argument is sound.
If the purpose of every argument is to prevail, then sure, invoking morals in any discussion can seem like a tactic. Moral hypocrisy can be particularly exhausting.
If the invocation of morals is always evidence of manipulation, though, then any ethical position can be easily dismissed.
Moral hypocrisy is cynical. But that doesn’t erase the value of morals and ethics. Morality, sincerity, and rhetorical effectiveness are still very different things
If you believe in karmic justice, someone who lacked sufficient morals should just lose an argument even if they are now trying to use morals to put forward a sound argument.
You cannot use a moral high ground unless you’ve earned that high ground through your past behavior.
Only tangentially related, but I've recently realized that unless you're some sort of business with a valid requirement of that, you can just block incoming traffic from all of AWS, DigitalOcean, Azure, etc.
I think the spark came from some other HN comment I saw? So thank you for that, whoever wrote that.
That alone is not a sufficient strategy of course, but you can get rid of a lot of bots by just refusing to talk to where they tend to live.
Of course, if everyone were to do that, they'd eventually pivot to residential proxies. But I don't see that happening.
Residential proxies are something that is not supposed to exist.
In the sense that you do not have people that actively sell those services via their home internet connection.
The whole thing just exists because there's this whole predatory ecosystem that uses malware and malicious devices to sell that without the owners even knowing.
That makes it legally questionable, even though I guess technically it is legal enough?
Still radioactive, so as a serious business, you do not want to be seen doing that.
Actually a lot of them do get sold. Rates range from about $0.10/GB (the middleman takes double that if course) for a program running on your computer, to $200/month for a dedicated extra connection installed at your house.
They exist because of GeoIP databases, and spying on "quality of IP address via ASN".
If you try to use a normal VPN, you get rate limited or blocked everywhere. But if you switch to a residential proxy, all those problems go away.
To be fair, if all you're doing is torrenting or similar copyright infringing actions, then a simple VPN is sufficient. But if you want to do web stuff, you gotta use a residential vpn. Not much way around this.
That was not the question.
There are many factors driving crime, yes.
The point however is that this is crime and crime is incorrect and fundamentally shouldn't exist.
But, more importantly, as a serious business, you do not want to be seen doing crime or benefitting from crime or supporting crime or being near crime. At least in a working society that is.
First, copyright violation as non-profit is a tort.
Secondly, it's only for-profit copyright violations that are a crime. But as OFCOM learned the hard way, stuff illegal in the US can be legal elsewhere.
Thirdly, for some fucking reason, the US AI companies are immune to criminal statutes of for-profit copyright violations. Job creators, or some bullshit.
And I'm not sure exactly why you're so dead-set on "crime crime crime". It's all politics and manufactured criminality. And well, I don't particularly care if backing up my movies to a Jellyfin and sharing access is "ill eagle".
The AI companies are bulk pirating AND then selling that access.... But I'm the criminal? Fuck that noise.
If the content is legally obtainable, couldn’t any employee use their own home network to pull data? I don’t think anyone would bother with a resi. Employees have their own network connections available.
I initially thought this was a good idea too until another comment pointed out you'll lose most business or personal customers in offices because they connect through VPN gateways running on those cloud services (especially Azure)
I would argue that more often than not it might not. Really depends on the specifics though.
A lot of stuff on the web actually isn't really relevant for all audiences everywhere I'd say. It just happened to be accessible by all, because academics back in the day dreamt of a better open world that didn't really manifest :(
Let me tell you, at the business I work at, some of our customers work at a company that uses a commercial VDI service for all workstations couldn’t access our service because the VDI egress was in GCP and we had an AWS WAF rule banning datacenter IPs.
Obviously, we removed the rule because it was doing nothing useful but plenty of harm. Real bots come from residential IPs.
It's really not, unless the only qualifier for that is "hosted by a VC incubator". Most of the people here are here to argue about AI or Crypto or whatever, or read announcements from Nvidia and Google. I would bet less then 1% are starting businesses.
And even if we run with that assumption, one might still be fine. It's a trade-off, but, depending on the target audience, a few lost sales might be worth savings in other aspects.
Who said we control the connecting device? This is a website. Websites are usually pretty arms-length things, and that’s the case with us. They’re our customers but we can’t install certificates on their computers and enforce mTLS. Can you do that with any of your customers?
reddit has been banning reddit accounts of people who use public cloud services as a vpn i.e. while travelling or in cafes, without recourse. Reddit's answer was afaik "don't do that, and create a new account."
Some companies don't split because they want all internet traffic to go through their internal MITM proxies to enforce acceptable internet use and data loss policies.
Same, I just checked and this week the vast majority of the bot traffic I get is random residential IPs that all pretend to be the exact same Chrome 155 on Linux.
I saw these things being sold for $300 at my local State Fair just a week ago. First heard about them a few months back on the Darknet Diaries podcast: https://darknetdiaries.com/episode/172/
Yeah it's definitely sketchy, but a "media access box" that purports to replace $100 a month in streaming bills with pirate media is kinda awesome.
Of course, the countries the Jellyfin and Plex servers along with IPTV dealers aren't illegal there.
And sure, your device becomes a residential proxy. They don't make that fact clear... But if you told people, I think for that $100-$200 a month streaming bills go poof is probably worth it.
Meh. It's awesome until the links stop working and the app goes dead because of regulators catching on.
I remember there being a plague of kodi plugins that worked for that kind of stuff for a long time, and they would die and be replaced every couple of weeks, sometimes they would have malware in them, it was a whole thing.
I think that if you want streaming and want to save money, the best practice is to only have one streaming service at a time. When you get bored with it, shut it down or pause it and move to the next one. It's a pain, but at least it won't infect every device on your home network and contribute to a bot farm.
Same shape here, and it is easy to miss because they impersonate a browser well enough that the request itself looks human. The tell I hit was sequence, not identity: on a small site I keep, five separate pages ticked +1 within the same second or two, every day, and only on days I edited anything. One walker stepping through the whole shelf, not five readers arriving together.
Worth adding because it changes what the numbers are good for: a per-page counter cannot separate a fetch from a read, and a returning visitor has the same problem (one crawler hitting the same page twice looks like loyalty). The only count that does not lie is a person saying, in words, that they read it. Everything else is a probability estimate shaped like a fact. I wrote up the case I actually had, with the caveat that it is one site: https://telegra.ph/A-count-proves-a-fetch-not-a-read-10-27
Depending on the service, you may not want it to be indexed anyway (IE login pages) or, if you do, most commercial crawlers have methods to allow site owners to verify that the traffic is a legitimate crawler and not an impersonator, see:
That wouldn't work if a sysadmin implemented the rDNS lookup mentioned in TFA. The PTR specifically must end in `.googlebot.com`, not `.googleusercontent.com`.
I currently tarpit traffic from AWS, Azure, GCP, etc. since it's not like any of my real customers have their PC inside those networks. (I then use that for experiments with providing bogus data to AI scrapers.)
Doesn't do much to help with the "VPN that uses random consumer PCs and phones" traffic.
Then you are not looking. Already have to switch to resi proxies from time to time when encountering yet another smartass who decided to play security theater and block datacenter ips on his shitpile he calls website, because "OUR USERS MUST BE GOOD BOYS WHO LOVE TO LIVE UNDER SURVILANCE AND ALLOW ISP TO TRACK THEM 24/7" (and before you say something like "others can track you too!", your ISP has the ability to knock on your door, they should be given as little information as possible, let them do metadata analysis on per-person basis if they really want it, but no 1-click mass surveillance shit).
If you are valuable, you will be be scraped. Turning user hostile in a hopeless endeavor to "protect yourself" is not the solution.
I can see that you're having strong emotions about this, but that rant is just hard to read and serves primarily as venting and not really to convince anyone of anything.
Unless one zooms out and thinks "okay, these guys seem to react negatively if we do exactly that. We should do more of it", which is probably not what you want.
It does, measurably. A massively popular site is going to get hammered with more advanced types of scraping, but they're going to have a team that can more easily mitigate it.
A site that doesn't care about corporate users basically loses nothing.
I trust my ISP far more than I trust bigtech. The downside of connecting from my ISP is that the site I connect to can fingerprint me trivially from the IP range
I'm sympatic to open3dlab but I think the focus on adult-content is just trying to spark outcry for cheap.
It has been shown times and times against that removing adult content from the training source (at least for diffusion models), results in generally lower-quality output, even outside of adult-content, particularly in terms of representing human bodies.
would the implied intent (from the inclusion of adult content) of training models on open3dlab content, without asking them, render Roblox's actions _less_ antisocial???
The current AI Ethos is morality is just another obstacle on the way to their IPO. ...Lets just hope after they get rich, they stay away, and dont bother us with books, videos and conference speeches on entrepreneurship mentoring...
Not really. Given that roblox is almost entirely children, and given the amount of hot water they're in you'd think they'd stay the hell away from adult content
Discord knows I'm an adult and keeps trying to send me "promoted Quests" to go use Roblox. That seems sketchy to keep baiting adults into childrens' spaces, too.
Roblox has lasted so long because it's not a specific game which is only relevant to a particular audience, it's a platform for whoever the users are to create and share games/content with others.
I never really liked it because of the virtual economy aspect, but the only link between Discord having quests on Roblox or adults playing Roblox and kids is that's the majority of the userbase and therefor content, not that it's only for kids.
> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.
The fact someone else may have licenced content for commercial use doesn't entitle someone else to do the same without paying for it. That's the whole point of copyright law.
And before you agitate against that, think deeply about the consequences. A world where website owners can legally dictate exactly what software you use to access their content.
They didn't say illegal, they said wrong. And they were right. You even agree with them by saying "It's not nice". Non-nice things are wrong in some way.
And, we already live in a world where website owners can legally dictate exactly what software you use to access their content. They can require that you log in with specific browsers running specific software on your computer, they way online schools run exam proxies.
We do not in fact live in that world. It is not illegal to violate the terms of service of a website.
A website can block Xyz user agent, put Xyz in robots.txt, or even put "No using Xyz!" in a popup and you cannot be prosecuted for using Xyz. It might be hard for you to evade their requirements, but it's not illegal.
Whether or not it's wrong is a matter of opinion. Yours differs from mine, that's fine.
US case law may not be on your side there. Generally unless you require a login to access the site (and even then you can only really ban for terms of service rather than recover damages unless they hacked around login requirements) judges have found that using scrappers on publicly served data is fair use. It gets murkier with creative content (rather than straight data) in what they can do with it after scrapping but the scrapping itself would still be 'legal' in the they can do it without judicial consequence sense.
It's one of the reasons why sites that served a lot of data used to have APIs or back channels to get that data even if they technically made money by serving ads on pages of that data, because they were going to get scrapped no matter what, so having a legitimate way to get data that behaved nicely with the servers and was nicely readable by requestors was win-win or at least not lose-lose.
The news is that people download it so much that they saturate your server’s connection and/or peg its CPU or disk (whichever is the weakest link in the chain). We used to call this a Denial of Service attack but now it’s apparently just a cost of doing business, even for people who just want to run a non-commercial hobby site.
The effect is a denial of service. Service is denied because the server is overloaded. The intent is at best callous indifference and at worst is copyright infringement.
It’s comparable to broadcasting radio interference as a side effect of some industrial process. If a company were to do that they’d be slapped down hard by the FCC. The unfortunate reality we live in is that we have no equivalent regulation on the internet. Thus the situation has become a tragedy of the commons: small websites suffer denial of service due to unsustainable and unwanted bot traffic.
Man if only there was such a thing as good manners, good behaviour, accepted practices from a community to not massively hammer servers. If only these websites had been up for a decade with very few problems, before a notoriously manipulative, lying, deceiving, abusive company that makes money off of child abusers came in and just went hurr durr free data in the WORST possible way instead of just politely asking for a dump.
The entire article points the finger at "roblox" as an entity, but the behavior seems to indicate it's just an individual doing the scraping - possibly not for corp use.
Look at the timelines - this scraper was running on someone's laptop: it turns off when they shut down for the weekend and lunch.
It's certainly possible, but I'd say the evidence fits the opposite explanation more: if it was not for business purposes, why do it on your work machine, during working hours, with your work email address in the User-agent?
I mean, it's not the size of the download, it's the unauthorised scraping of community assets strictly against terms and ignoring robots.txt by an American corporation. Resource of a kind that used to get kids threatened with spending most of their life in prison.
But I agree that this kind of theft by US corporations is no longer news.
(Yes, it's theft: they were aware they may not do it and according to the article attempted to get around further restrictions. I mean it's literally even theft of the $3 you mention — you don't have to be in possession the $3 to illegally deprive its owner of it under common theft statutes)
maybe stupid question but how is it possible to not be protected against supercrawlers like this, when you own large amounts of data, specially if all requests are coming from the same server ? Aren't cyberprotection services like CloudFlare work against this kind of "attacks" ?
then in the post "It came from a single Amazon Web Services (AWS) address. It had read the main page of 18,926 projects, which is practically our entire catalogue, in 26,429 requests over a span of 34 hours."
sounds like some R&D dude running solo to be honest, nothing about that is a supercrawler lol
Yeah, I can imagine it being a problem if it was from different IP addresses, but surely putting a limit on requests from a single IP would be a straightforward fix? Although maybe until it happens, you don't think about it.
These services cost money. Scrapers also cost money in terms of resource utilization and downtime. There's always a tradeoff.
The ROI of services like Cloudflare bot protection, Datadome, HUMAN, AWS bot mitigation etc. is highly dependent on your income from the data. In the case of publicly hosted freely accessible data it can be hard to justify.
> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.
It's a community site, first model I looked at (Tanya by Shrimport) is under CC-BY-ND-NC licence (Creative Commons, By attribution, No-derivatives, Non-commercial).
AI training by definition is derivative, and Roblox not using it for commercial purposes if used in production is practically nil.
This is a huge part of why AI upsets people, we can't have nice things such as communities where people are sharing 3d models without it being feeding ground for commercial companies that has little intention to ever honor any licences or compensate authors.
Except someone can explicitly licence their content saying "this cannot be used for training models, or you're violating the licence you used to download it in the first place".
If you expect visitors to ask before downloading your content, making it simply fetchable with HTTPS on the open Internet is a bad way of implementing that requirement.
You need an actual workflow where the visitor has to initiate asking, and then wait for the request to be reviewed and granted.
So, where is your security? After 145 gb of stealing you started your blocking? Rate limitation should be automatically enabled instead of waiting and inspecting the traffic.
Honestly I don't see the issue at all. So long as your infrastructure can handle it and there is no cost to you it should be fine.
The only proviso is that you should not be able to block distillation on your models you trained using others data.
I also don't appreciate the sensational framing of adult content here, it's purely meant to appeal to irrational emotions. We all know how models train, input and output are very different things here.
New kids often don't want to be in the same space as where the "new adults" are though, that's uncool. See: literally any social media site since forever.
I love that the scraper took a break over lunch. Just someone hitting pause on scraping gb's of Zelda models to get a sandwich and then firing it back up.
Fixating on the adult content is weird. Why make so many moral judgements about what Roblox is or isn't doing with the data? It is trivial to run a script to filter out stuff that doesn't meet your standard after you download it. You also need a ton of adult content to train classifiers that detect and remove adult content.
Farming outrage by implying "Roblox is downloading adult content to show to kids!!!" with zero proof is pathetic.
It's entirely plausible to me that they could be training an NSFW 3D model detector, specifically because of their very minor userbase. TFA seems to presume it's all being used to train genAI, in exactly the same fashion.
We know NSFW data pollutes many otherwise non-adult datasets, so genAI is going to be trained on naughty stuff inadvertantly regardless - they might need a smut neuron specifically to turn off that sort of output.
Or they are just being irresponsible. point is, we dont know.
It's still a tad icky to scrape tons of data without asking, and downright rude to ignore robots.txt and ToS, but that's the world we live in.
I have a friend who was working at Roblox on in house classifier evals on texture generation (I think they were working with some enterprise version of Stable Diffusion?), specifically on adult content filtering and protected IP replication. That company seems predatory in many ways to me, but I'm pretty sure they aren't intentionally giving kids the ability to generate pornographic content on their platform.
The internet must understand one simple rule. What’s downloadable will always be downloaded. There are plenty of people who don’t give a flying fk about your LICENSE.md, robots.txt, ToS and whatnot. It’s like leaving your bike unlocked in the public. Even if there is a giant cardboard next to it saying: “please, don’t steal the bike” - nobody cares. Someone will strikethrough the “don’t” and grab the bike.
I know it is an unpopular opinion, but if you do not want your content to be scraped, you have to put it behind payment walls and copyright it. In Germany we have decisions from the highest courts that deemed websracping perfectly legal (it was in the context of a competitor scraping airline ticket fares).
And how were those license conditions violated by downloading? Their are permissive in the first place, and violating without passing on to a third party is almost impossible.
Supposedly they are, that is enforceable how? Download is not anything. Training AI on them is not anything. Using the trained model is not a violation of the terms just because you think it should be.
i see. as long as i can download Software that is made available for free for students its completely legal to do so and use them commercially as a non-student, after all its freely downloadable.
good thing you explained how copyright works legally, almost spend my money unnecessarily.
COPYright becomes relevant once you COPY something. As in, give it to a third party. I don't see any third party involved here. The download itself is not subject to copyright - licensing terms may or may not apply - and just because the license text says something doesn't mean it holds up in court.
Til you can download something without copying said something.
Wouldve been great to know for people that have been found guilty after downloading illegal and unlicensed content.
Fyi, the nation you mentioned (Germany) adheres to a much stricter concept called Urheberrecht. Under this regulation, you're actually in even more legal trouble. Though Roblox ain't German, so kinda irrelevant, admittedly
German Urheberrecht explicitly states, that downloading something is legal, if not downloaded from an obviously illegal source ("offensichtlich illegale quelle"). Thats why it is perfectly legal to download copyrighted music from youtube (because Youtube is obviously NOT illegal). Youtube ToS are irrelevant in that case. You are however still not allowed to copy the data (music) to a third party (that is when copyright starts).
Whether or not the file you downloaded was even allowed to be uploaded to that website, is irrelevant in that case. Then the uploader and provider are liable, not you the downloader.
> Urheberrecht explicitly states, that downloading something is legal
Technically right with your phrasing, but wrong considering the context.
That exception is explicitly about the fact that eg pictures served on a website will be copied to the local cache and can still be shown without violating it. But besides that, nobody argued that the download itself was the license violation.
If Roblox only downloaded and then deleted it without using it in any way, they'd not have violated the license. Was that the point you were making? If so okay, that's true but from my perspective a pretty stupid view. Surely you're aware that they didn't?
Tons of those are (as the site admins admit) models that are themselves infringing on copyright, and thus any license based on copyright ownership is invalid.
You can't enforce a license on a 3d model you in turn stole from a game.
No, it means that Actor B has no copyright at all. Copyright requires ownership, and a thief has none. So Actor A (e.g. Activision) can make a copyright complaint against Roblox, for their 3D model that Roblox now has, that Actor B was illegally hosting. Actor B can't say crap.
As an artist, there is the temptation to hoard my works like Smaug on his hill of treasure. But I got past that in a moment of weed-inspired revelation : I am the fruit-bearing tree. Therefore my wealth is infinite. In fact every fruit I bear is better than the last. So giving it away is not such a biggie. And clutching it to my breast like a boney vampire is in fact detrimental to my process. I put great faith in the process.
I'm just to ignorant to this in context of how the reality just works.
Downloading content on the web is what the web is for. Using the data for training is something lawers need to figure out.
open3dlab should spend the time and energy, as unfortunate it is, to sue them to get this resolved.
Ablog post about this is basically 0 information. The stories about soooo many bots now crawling the internet and creating a lot more traffic is going through news and hn for month.
Look, I'm usually pretty sympathetic when people complain about drive-by AI scraping like this, but the amount of pearl-clutching here is exhausting.
Yes, it's a game for kids. Yes, the company that makes it just scraped up a bunch of adult content. No, that does not mean they are going to give adult content to children.
Whoever wrote this was aiming to be as aggrieved as possible. It's performative, and I am having trouble taking it seriously.
Of course not. But there’s no indication whatsoever that any license has been violated. Downloading a file from a free access server cannot violate license terms.
Fear that something will happen is not the same thing as evidence it has happened.
> If you're downloading it for commercial purposes (clearly the case) you're violating the license.
No. Copyright doesn’t work that way, no matter how much you might wish it did. And it’s a very important thing for the web that it doesn’t.
Legally speaking, it is extremely well established that downloading is not the type of copying that “copyright” concerns itself with. And the GPL and similar licenses are predicated on copyright laws.
Once you make the content available in some other way, then copyright law might have something to say.
People in tech used to make fun of “you wouldn’t download a car”. It’s sad that so many have reversed their principles the moment a convenient villain shows up.
You may remember from 2021 that Microsoft's Copilot would gladly regurgitate the GPL-licensed Quake 3 source code, without giving you any indication it got it from there or that the GPL applies.
> Can I scrape all GPL source code from github. Then use the code commercially and then say so what, they made their source code available to download?
Yes, that's the whole point of the GPL. Use it however you want, but don't restrict the next person
I think technically such a model should abide by the licence of the inputs, hence all models would probably be GPL if the FSF had resources to fight it and the legal profession had an inkling of the processes involved.
Or maybe the FSF is just waiting for everyone using AI code to become hooked and then subpoena every Antrophic/OAI/Codex customer and force the most massive source release in history (If Adobe/MS would file lawsuits vs the Craft apps and with their resources create legal precedent it could create chaos, maybe the only part stopping them right now from filing lawsuits is them realizing it could backfire since they're heavy AI users themselves).
A while back I was thinking it wouldn't be enforced, but the entire Craft-clones and REA tools usage explosion kinda hints that disassembling/rebuilding the source is cheap enough that LLM's(ironically) could probably quickly find culprits if you had suspicions about certain apps.
Does it matter? Lawyers don't know either since most majorer cases are still in progress.
So far it seems more cases that have been decided in lower instances or has been settled or gone in the direction of the party with most money for lawyers, still even in those cases there seems to be a slight tilt towards rightsholders.
I'm not saying anything categorically, but if some cases go all the way and towards rightsholders, it could become a real shitshow in the software industry since we've adopted AI so heavily and the non-significatng portion of public GPL licenced code could bite people in the ass.
> Some examples include models of Eve from Stellar Blade, Mei from Overwatch, and a Horse cock dildo.
I don't know what's more wrong: that a dumb model started downloading "Horse cock dildo" 3D models (to which end? to stuff that virtual 3D "horse cock dildo" in its own virtual LLM ass?) ...
Or that there exist "horse cock dildo" 3D models.
Seriously in which world are we living?
And I should be thinking about the people who designed that horse cock dildo and care about them? And those viewing those/using those? 3D printing those maybe? And I should care about the retards who can't even prevent their crawler from downloading 145 GB full of horse cock 3D dildo models and the like?
Nah. Fuck that, I care about my family and you're all on your own.
Who actually cares? Isn't the whole premise of the AI revolution just gorging ourselves with other people's data so we can have AGI? I was under the impression that we have accepted this sacrifice with OAI and friends leading the way.
Crypto, big data, AI. It's all just another middle man hoping to scrape some joy out of everyone's lives to they can put a price tag on it and sell it to rubes and the government(and rubes in the government).
Scientists say this is the first occurance of the word "model" in the title of a post on HN that does not refer to a neural network of some sort since 2023
You're laughing, but they're probably going to use these models to train a model and allow players design their characters from a prompt.
Already done: https://github.com/roblox/cube
Do they update this frequently enough?
Personally, I'd never build on top of Roblox itself, but... and I hate to say this, if they made a generic 3D service that let you export to any game engine, I think I'd pay Roblox for said tool if it was good enough, which, they have so many games and capital, I could see them pulling that off, I mean they already have a base model.
I would love to see more text to 3D model models that can wire up straight to a game engine, I think we'll see a lot of interesting things, like children prompting the worlds of their imagination into reality, and the 50 million memes that will plague social media.
> I would love to see more text to 3D model models that can wire up straight to a game engine
Same, but none of the models actually have good enough output yet to make that work. Currently they're all aiming to "fake" the niceness by doing modeling+texturing, but when you look at the wireframe, it's pretty clear they're very far of from being usable, even less so in a game where performance matters a great deal, and you can't just YOLO assets however you want, which is what the "text to 3D" models like to do.
Inevitable that we'll get there eventually though, it's miles ahead where it was just 1-2 years ago. I guess my point is that it's not the "3D model > game engine" that is lacking at the moment, but "text > 3D model" that cannot produce high quality enough results.
I wonder if the solution is either an intermediary "model spec" that can render into others (this becomes the target for all these model models), or an LLM style hack where its trained on recreating 3D models using code, I know for CAD (I forget which one it is) there's a CAD program where your models / designs can be written in code.
One weird thing I run into is, I can have Claude make some interesting things with threejs, but translating it to other engines isn't always so great, and its usually raw code. I'm not a 3D guy, I just want to get up and running with things I can code / think of.
Design models with a model trained on models. It’s quite straightforward
All models are wrong, but some models are trained on models of models and still wrong.
https://en.wikipedia.org/wiki/All_models_are_wrong
I'm sure one could recreate a look of some popular model. So the model trained on models then would generate a model of a model.
but I'd prefer to have an industry expert involved, for the accuracy of the model, model to supervise and co-create model trained on models then would generate a model of a model.
Model the model model on the model model model and you'll be fine.
As long as the models are not modal, this will work. Modal models are a miserable method of momputer minterface mesign.
I modeled a model that’l allow you to model your own model dawg
How’s that for a throw back
As photographer, I find it hard to work with your model. It's like it has no training and just sits there waiting to be told what to do. I spend more time explaining what I want the model to do than actually working with the model. Maybe I should shell out for a professional model instead of working the the open models hoping to be a professional one day.
> Some examples include models of Eve from Stellar Blade, Mei from Overwatch, and a Horse cock dildo.
Lmao!
For "research" purposes, no doubt.
You laugh, but this is the kind of data that allows you to train models that actually catch a lot of corner cases, as well as generalizing to other 3D applications.
I'm not gonna comment on the morality of mass acquisition of all of this data, but as someone who deals in 3d in the medical/dental space everyday..
there's absolutely no doubt that all of that data is as valuable as gold in research.
On a tangential but related note..
I mean, people in possession of troves of data, especially in the medical or 3D industries, really ought to start understanding the value of the data they're sitting on. You can give it away if you like, but don't be upset when someone turns it into a couple hundred billion dollars and doesn't compensate you.
If you won't like it if tech companies rip you off, then take the legally required steps to protect your data. (That includes making sure you licensed your data properly. And protecting your data with explicit use licenses and, potentially, even access controls.)
How can you start an outcry like this, but host stuff like this, tagged with a permissive license:
https://open3dlab.com/project/e2a0830d-f166-4b1b-aabf-8ca735...
Just an example, there's plenty more on the frontpage.
I have nothing against these guys, but I just can't understand the moral high ground of the complaint.
If you read the article, you'd find they admit to that, their position is nuanced, and this is not a "gotcha".
> We'll be honest about where we stand. We don't like copyright as it exists. We'd like to see it radically reformed, and we wouldn't mourn it if it were abolished. Our community lives in its grey areas every day: many of the models on our sites are fan ports of characters from commercial games, made out of love and shared for free. When a studio sends us a takedown notice, we comply.
> While we as small artists and fan communities get copyright used against us, the world's largest companies are committing copyright infringement at a scale unseen in human history. This has been the case since the invention of the internet of course; digital media make duplication, remixing and resharing trivial, but copyright law never caught up. Filesharing stabbed copyright in the gut. AI is just twisting the knife, and completes the creation an unequal system where copyright infringement is only a crime if you're a low net worth individual.
Rich companies are infringing copyright at industrial scale in order to build their LLMs, and even if caught and challenged, they don't suffer any catastrophic punishment. The infringed party gets enough money to shut them up and everyone moves on. A fine is a price. They'll keep doing it with impunity. Meanwhile the small guy who doesn't have copyright lawyers on retainer is getting shafted, time and time again.
"When a studio sends us a takedown notice, we comply." Well, yes, obviously they have to, or risk not existing anymore.
Also, "fan ports" is doing a lot of the heavy lifting. They're assets extracted from commercial games, uploaded with whatever license the person who extracted and packaged them chooses.
From their argument, if they truly think copyright should be abolished, an LLM capable of remixing that work into whatever you want would be a good thing, right? Ultimately this would empower the end-users of the models.
There's an argument to be made that these models trained on the world's knowledge shouldn't be locked behind closed models controlled only by big corps, but in this case it's good that anyone can download data and train such a model, right?
I can't speak for roblox intentions, and I am well aware of their history. But so far they seem to have published at least some of their model work to HuggingFace: https://huggingface.co/Roblox/
What nuance am I missing?
I've seen my son play Sonic the Hedgehog games in Roblox that were straight rips from the original games (at least visually and play-wise). I'm not really sure how it was done (extracting actual assets from the game, or just a dedicated user very familiar with the original game), but there are quite a few recreations of other games on Roblox that are just as good as the originals.
> Rich companies are infringing copyright at industrial scale in order to build their LLMs, and even if caught and challenged, they don't suffer any catastrophic punishment
And the same thing is happening here? They’re hosting copyrighted materials and have also not suffered catastrophic punishment.
Their infringement is different, and would really be a trademark issue if we hadn’t just invented the idea of copyrighting a character separately from the story they are a part of in the ‘30s (they are not individually copyrightable under the original text).
There’s a substantive difference between ingesting other people’s work and hosting copies of fans knockoff models of their favorite characters.
It’s even weirder because in other mediums this wouldn’t even be a thing. Nobody gets nearly as up in arms about fans doing their own cuts of movies, or re-using characters in written fan fiction, or etc. Very odd to me how up in arms people get about this specifically for visual art.
I think this is an important point we need to grapple with more and more in the future. We like to think an act as either lawful or not lawful, either ethical or not ethical. We need to bring in scale as a separate axis. There's a world of difference whether an activity is done at human scale or machine scale. At human scale, it's an act of deviance that may contribute to the diversity of human experience. At machine scale, it's a distortion that threatens the society.
The internet was built on aggregators and crawlers, it only matters when people are not getting paid... I prefer the internet to be unregulated, but whatever greed always wins
"It's OK if I do it, but not if someone more successful than me does it" is still blatant hypocrisy.
"it's ok if a rich person or company does it, but not if someone less rich does it" is equally blatant hypocrisy that is worse for society.
What is the relevance to this case? Isn’t this site less rich than Roblox and their hosting copyrighted items and they’re not getting punished.
Or am I misreading the situation?
In order to follow, you would need to first read the post I replied to, and answer your question as it pertains to that post.
I agree? How is that relevant here?
But it is okay if not-rich people do it. I have "pirated" and otherwise flaunted copyright my whole life, along with many millions more. Nobody has ever come at me for it. Enforcement of any sort against common people is exceedingly rare. For a long time it was only corporations who took copyright seriously, and now that even they are flaunting copyright people such as yourself suddenly pretend that the little guy has to care.
Well I don't! Copyright is a farce and I continue to wipe my butt with it.
This thread of comments seems to be getting somewhat off topic. I believe the point being made by open3dlabs is that copyright is basically a pay to play system for corporations which is obviously unjust. You're right that copyright isn't enforced on individuals, but DMCA is definitely enforced on small content sharing sites which have little to no recourse compared to large corporations that can flagrantly break the law.
Exactly. It's like the Clean Air act. Nobody's coming looking for your wood stove but they'll happily pull a million bucks out of some podunk business who's maintenance guys were foolish enough to use up an old case of paint that predates whatever the modern VOC regulations are.
Just because individuals aren't an enforcement target doesn't mean enforcement isn't happening.
> But it is okay if not-rich people do it
Are you sure you replied to the right post? You're agreeing with me here.
The post I replied to is the one suggesting that us little people doing this is at least as bad as rich people and rich corps doing it.
Yep, this is basically the outlook of ChatGPT etc in america, when they try and stop china scraping them. I hope they go bust as soon as possible.
Honestly people need to wake up to this industrial level theft, and get some laws in place. If someone did this by hand you'd call it either a DDOS or IP theft, even if license is permissive. Just cos its from a machine doesn't excuse.
https://open3dlab.com/project/04d18c1b-c508-4017-be7b-766904...
Straight up theft, not fan recreations, theft.
Indeed. And they're not even pretending to keep an arms-length distance from their users' infringement; they're openly promoting it,
https://www.youtube.com/watch?v=MidugiRfHaY ("Ripping Encrypted Unreal Engine Models" | Open3DLab)
(Found via a sidebar ad on their webpage).
I have a question/thought/philosophy. If AES is a relatively strong encryption method right now, _why don't we wait to crack the assets until the encryption method is easy to decrypt_? By the time that's possible, the game assets will likely be old as shit, so it would potentially sit better with everyone. If we wait, it takes on a more archival type feeling.
Is your question "why don't decentralized humans appropriately self-regulate?"?
I understand importance of preservation, but frankly, the English WWW seem to massively and simultaneously overestimate rarity and undervalue financial costs of creative assets like 3D models and 2D images.
It's not rare that these assets cost in ranges of $10k and made in less than dozen man-hours each. They're not harvested and collected, but artificially created by individuals by work orders or as their own projects. A lot of these conversation feels like people are talking about something similar to Louvre collection items that cannot be obtained other than by somewhat illicit means, leading to discussions of which illicit means will be tolerated in the name of preservation.
No, it's something they make as we speak on Blender. Like with a mouse and a keyboard, or sometimes with a pen tablet. I think the anglosphere Internet hasn't yet reached the point where justification of dubious means can be discussed; we're at the phase where it should be educated to people more often that these are man-made creations that each has economic values.
I think you are missing the point here. The art assets in question belong to the studio. Yes, they are painstakingly made. They are made with the assistance of some very very expensive technologies. Full body scans. Facial rigging with 180 high fps cameras. Mocap suits and props in a full blown warehouse studio. The works. It's not just a 3D model. It's a rigged 3d digital twin of an actor. There's image rights, etc that have to be negotiated and deals made. Preservation would be to preserve the data as is rather than reworking it into a blender scene.
My point is about endemic lack of general understanding for these types of arts on English part of the Internet/WWW, no offense to GP intended. It feels like listening to museum curators discussing "oil on canvas" without ever having set foot on a store that have tubes of paints and canvases on the shelf and Apple Pay stickers at the cashier.
Without more widespread recognition about how these models, arts, games, etc., are artificially made by humans, and not magically discovered, I think discussions as to how they should be handled will be always a bit off, whichever way it would go. That's my point.
Without getting into the much debated philosophy of restoration/display of preserved things and how restoration can often cause degradation to the original piece, consider that just preserving the data in the manner you suggest also requires preserving the original software if you ever want to view it. Which requires not just preserving that original software but also all the external hardware and software that original software relies on. Quite often that's a dead end as it requires preserving an activation/license server that the preservers don't have access to.
That isn’t true, you preserve the data as is for the software as is. You can emulate under it if you need to run it. This is what internet archive has done and the proper preservation of the media is in tact. In NO WAY do you ever need to convert the data back to a workable source in its original authoring program.
You are wrong, you are basically saying "black cats exist therefore cats can't be tabby", there are plenty of preservation initiatives that preserve works in different forms when the original media can not be practically preserved or displayed. Yes best practice is to preserve as close to initial state as possible, that does not mean that when you cannot feasibly preserve the work in it's original state (with digital it's often due to drm) that you just say screw it nothing we can do but chuck it in the dustbin of history.
circumventing DRM is exactly what separates breaking the law from preservation...
That's like saying bank robbers don't actually shoot guns, only people who use guns legally shoot them. It's still preservation. Or even more apt saying archeologists aren't archeologists they're tomb raiders. They may be tomb raiders but they are still archeologists.
Because "we" want the assets now, and not when we're 60 years old?
Because "we" want the assets now?
According to the timestamp, that was uploaded less than 24 hours ago.
I'm not familiar with their site; I assume it's user-uploaded? In that case, it's the same challenge that every user-generated content site has, balancing openness with policing IP violations.
their staff posts these things. their staff creates videos of how to rip assets from games. they are fully aware of what their users are doing and they openly encourage it.
Oddly, this makes their argument even stronger. Why would Roblox download this?
The game at the moment is capture as much content as possible.
.. why not? They need models, models are free, so they grab them. They have time to sort them out later.
To train their LLM
DMCA safe harbor? They're not responsible for user uploads until they are made aware of violations.
Scroll through the site, there are A LOT of assets from games, packaged by users. It's a nice subtrefuge, in practice it is a place to get ripped assets and the platform washes it's hands.
Again, I don't have any particularly strong issue with this, just with the pearl clutching regarding roblox downloading the data.
Party A: hosts largely copyrighted material, says they are opposed to copyright in its current form
Party B: massive IP business , very aggressive about everything from brand to software, defends and monetizes current copyright regime
I think it’s fair for party A to call out party B for downloading a massive trove of known-copyrighted material.
Then Roblox trains on it and voila…
Game companies generally don't care if you don't make money from your mods or fan projects. And yes technically copyright nowadays lasts until the heat death of the universe but 10 year old games are in commercial limbo.
Ofcourse AI providers very much DO want to make money with their trained models.
Considering you link something that has a non comnercial license CC-by-NC, there might be others with permissive licenses. There might be things in their TOS of the site,
There's more with different licenses. If you scroll through the pages, there are a lot of assets ripped from games, with a variety of licenses CC-by-NC, or just "beerware":
https://open3dlab.com/project/0a4538ba-00df-4f6d-b3e3-14d978...
Yet you chose this poor example.
Funnily enough the YouTube video that came up when I viewed the page was an instructional video on ripping models from Unreal Engine games.
Theft requires that you intentionally deprive the original owner of the object, this is copying.
This is the kind of misinformation that spreads around the internet without ever being fact checked.
Theft is the action or crime of stealing. The fact that some definitions include the concept of "with the intent to deprive the original owner of it" doesn't make digital theft not a theft.
Also, it could be argued that the theft of the IP is further substantiated by the loss of future potential revenue from that IP, as, after all, why would anyone pay the orignal owner and creator actual money when an AI agent will make an exact duplicate of said item and possibly further customize it for them as part of its already paid for product catalog?
I mean, it's not misinformation, though it may be incomplete. Taking the us example, in most states the larceny statute—the "crime" of theft, as you put it—does in fact require an intent to permanently deprive. Unlawful copying is not larceny or theft and no da could prosecutor could prosecute it under a larceny statute. It may of course be copyright infringement, which some people rhetorically analogize to theft. That analogy may be useful for some purposes, including for motivating normative intuitions. But it's categorically different as a matter of law.
Half their tutorials are how to rip models from games.
Individuals doing bad things is not the same as corporations doing bad things.
well it kinda worked? over on reddit r/gaming thinks the data has been stolen
more radicalization towards AI
Moral high grounds don't mean much these days. They are weaponized as a way to get an advantage in an argument.
Just remember, the morals of someone making an argument have no bearing on whether an argument is sound.
If the purpose of every argument is to prevail, then sure, invoking morals in any discussion can seem like a tactic. Moral hypocrisy can be particularly exhausting.
If the invocation of morals is always evidence of manipulation, though, then any ethical position can be easily dismissed.
Moral hypocrisy is cynical. But that doesn’t erase the value of morals and ethics. Morality, sincerity, and rhetorical effectiveness are still very different things
If you believe in karmic justice, someone who lacked sufficient morals should just lose an argument even if they are now trying to use morals to put forward a sound argument.
You cannot use a moral high ground unless you’ve earned that high ground through your past behavior.
Only tangentially related, but I've recently realized that unless you're some sort of business with a valid requirement of that, you can just block incoming traffic from all of AWS, DigitalOcean, Azure, etc.
I think the spark came from some other HN comment I saw? So thank you for that, whoever wrote that.
That alone is not a sufficient strategy of course, but you can get rid of a lot of bots by just refusing to talk to where they tend to live.
Of course, if everyone were to do that, they'd eventually pivot to residential proxies. But I don't see that happening.
There have been a number of articles on the frontpage of HN about the residential proxy traffic. It is happening. This was one of the most popular:
https://news.ycombinator.com/item?id=49491791
I know, but it's an extra step, more expensive, and less legally solid.
None of these measures alone are a full solution, but if you stack a bunch of cheese slices, eventually, no holes line up anymore.
... less legally solid? What?
Residential proxies are something that is not supposed to exist.
In the sense that you do not have people that actively sell those services via their home internet connection.
The whole thing just exists because there's this whole predatory ecosystem that uses malware and malicious devices to sell that without the owners even knowing.
That makes it legally questionable, even though I guess technically it is legal enough? Still radioactive, so as a serious business, you do not want to be seen doing that.
Actually a lot of them do get sold. Rates range from about $0.10/GB (the middleman takes double that if course) for a program running on your computer, to $200/month for a dedicated extra connection installed at your house.
They exist because of GeoIP databases, and spying on "quality of IP address via ASN".
If you try to use a normal VPN, you get rate limited or blocked everywhere. But if you switch to a residential proxy, all those problems go away.
To be fair, if all you're doing is torrenting or similar copyright infringing actions, then a simple VPN is sufficient. But if you want to do web stuff, you gotta use a residential vpn. Not much way around this.
That was not the question. There are many factors driving crime, yes.
The point however is that this is crime and crime is incorrect and fundamentally shouldn't exist.
But, more importantly, as a serious business, you do not want to be seen doing crime or benefitting from crime or supporting crime or being near crime. At least in a working society that is.
First, copyright violation as non-profit is a tort.
Secondly, it's only for-profit copyright violations that are a crime. But as OFCOM learned the hard way, stuff illegal in the US can be legal elsewhere.
Thirdly, for some fucking reason, the US AI companies are immune to criminal statutes of for-profit copyright violations. Job creators, or some bullshit.
And I'm not sure exactly why you're so dead-set on "crime crime crime". It's all politics and manufactured criminality. And well, I don't particularly care if backing up my movies to a Jellyfin and sharing access is "ill eagle".
The AI companies are bulk pirating AND then selling that access.... But I'm the criminal? Fuck that noise.
This whole discussion was not about you or what you do, but about the idea of blocking Datacenter ASNs against scraping and other bot activity.
Which then was countered with a broad range of classic HN dysfunction, hostility and pedantry.
When the truth of the matter is that it's actually just a decent idea for some use-cases and a less-decent idea for others.
But instead of acknowledging that nuance, an explosion of nonsense happened here.
I genuinely do not understand why you've suddenly started talking about yourself and your own residential proxy use? Why does that belong here?
Sure, that's why they sanitize the User-Ggent header when using these proxies. Good luck attributing the scraping to anyone at all.
It just needs one case where someone manages to attribute it to the corp using these illicit services.
Either by technical means or by a whistleblower.
Which might be a gamble worth doing, but also might not. And regardless, the fact that it is a gamble alone slows down velocity.
If the content is legally obtainable, couldn’t any employee use their own home network to pull data? I don’t think anyone would bother with a resi. Employees have their own network connections available.
Can you people please for the love of God stop missing the bigger picture?
Yes, yes there is always something. Yes there can always be workarounds.
But that is not the point. The point is that things are made harder. That is the point. To make things harder
Not impossible. Harder
Jesus Christ. It's all just a game of probabilities and friction. One needs to understand that to understand reality.
The scrapers and AI companies resorting to residential proxy traffic like intelligence and hackers is pretty crazy.
I initially thought this was a good idea too until another comment pointed out you'll lose most business or personal customers in offices because they connect through VPN gateways running on those cloud services (especially Azure)
True but the question is if that matters.
I would argue that more often than not it might not. Really depends on the specifics though.
A lot of stuff on the web actually isn't really relevant for all audiences everywhere I'd say. It just happened to be accessible by all, because academics back in the day dreamt of a better open world that didn't really manifest :(
> day dreamt of a better open world that didn't really manifest :(
it is open and better indeed. open and better for capital - the true, living, flesh-eating god.
This is a website about starting businesses.
Let me tell you, at the business I work at, some of our customers work at a company that uses a commercial VDI service for all workstations couldn’t access our service because the VDI egress was in GCP and we had an AWS WAF rule banning datacenter IPs.
Obviously, we removed the rule because it was doing nothing useful but plenty of harm. Real bots come from residential IPs.
> This is a website about starting businesses.
It's really not, unless the only qualifier for that is "hosted by a VC incubator". Most of the people here are here to argue about AI or Crypto or whatever, or read announcements from Nvidia and Google. I would bet less then 1% are starting businesses.
Hm I mean HN _also_ is that? But not exclusively.
And even if we run with that assumption, one might still be fine. It's a trade-off, but, depending on the target audience, a few lost sales might be worth savings in other aspects.
Can use cloudflare turnstile or similar instead
If you control the connecting device why not use MTLS?
Who said we control the connecting device? This is a website. Websites are usually pretty arms-length things, and that’s the case with us. They’re our customers but we can’t install certificates on their computers and enforce mTLS. Can you do that with any of your customers?
Someone accessing a VPN that's in an Azure IP range is going to have a difficult time using half of the Internet.
reddit has been banning reddit accounts of people who use public cloud services as a vpn i.e. while travelling or in cafes, without recourse. Reddit's answer was afaik "don't do that, and create a new account."
I would sure hope they split tunnel their VPN so all traffic isn't going through the VPN...
Some companies don't split because they want all internet traffic to go through their internal MITM proxies to enforce acceptable internet use and data loss policies.
Those had to switch over to endpoint agents installed on work devices directly due to TLS 1.3 preventing MITM for domains which you do not control.
> Those had to switch over to endpoint agents
No they didn't. https://news.ycombinator.com/item?id=32337698
i can't access reddit through nordvpn
All my business traffic comes from either our own AS, or from ZScaler's AS
Do many companies really use azure etc rather than dedicated services like zscaler?
Allmost all the bottraffic I see is from random residential proxies though.
Same, I just checked and this week the vast majority of the bot traffic I get is random residential IPs that all pretend to be the exact same Chrome 155 on Linux.
Probably all people that fell for the “superbox” TV streamer scam.
do you have a good link to learn about this ?
https://www.eff.org/deeplinks/2025/06/fbi-warning-iot-device...
That’s probably a decent starting point, but a little older. I am not sure if the situation has changed any in 2026.
I saw these things being sold for $300 at my local State Fair just a week ago. First heard about them a few months back on the Darknet Diaries podcast: https://darknetdiaries.com/episode/172/
Yeah it's definitely sketchy, but a "media access box" that purports to replace $100 a month in streaming bills with pirate media is kinda awesome.
Of course, the countries the Jellyfin and Plex servers along with IPTV dealers aren't illegal there.
And sure, your device becomes a residential proxy. They don't make that fact clear... But if you told people, I think for that $100-$200 a month streaming bills go poof is probably worth it.
Meh. It's awesome until the links stop working and the app goes dead because of regulators catching on.
I remember there being a plague of kodi plugins that worked for that kind of stuff for a long time, and they would die and be replaced every couple of weeks, sometimes they would have malware in them, it was a whole thing.
I think that if you want streaming and want to save money, the best practice is to only have one streaming service at a time. When you get bored with it, shut it down or pause it and move to the next one. It's a pain, but at least it won't infect every device on your home network and contribute to a bot farm.
Same shape here, and it is easy to miss because they impersonate a browser well enough that the request itself looks human. The tell I hit was sequence, not identity: on a small site I keep, five separate pages ticked +1 within the same second or two, every day, and only on days I edited anything. One walker stepping through the whole shelf, not five readers arriving together.
Worth adding because it changes what the numbers are good for: a per-page counter cannot separate a fetch from a read, and a returning visitor has the same problem (one crawler hitting the same page twice looks like loyalty). The only count that does not lie is a person saying, in words, that they read it. Everything else is a probability estimate shaped like a fact. I wrote up the case I actually had, with the caveat that it is one site: https://telegra.ph/A-count-proves-a-fetch-not-a-read-10-27
Please keep this kind of AI-written comment out of the forum. If you have something worth saying, say it yourself!
If you block datacenter IP you’re also going to block all of the legitimate search engine crawlers.
Depending on the service, you may not want it to be indexed anyway (IE login pages) or, if you do, most commercial crawlers have methods to allow site owners to verify that the traffic is a legitimate crawler and not an impersonator, see:
https://developers.google.com/crawling/docs/crawlers-fetcher...
(Though restricting the Google UA to only legitimate Google IPs seemingly would break Brave's crawler, though that's their own fault: https://safe.search.brave.com/help/brave-search-crawler/)
https://duckduckgo.com/duckduckgo-help-pages/results/duckduc...
https://www.bing.com/webmasters/help/how-to-verify-bingbot-3...
https://kagi.com/bot
It is trivial to forge a Google bot user agent and scrape through GCP.
That wouldn't work if a sysadmin implemented the rDNS lookup mentioned in TFA. The PTR specifically must end in `.googlebot.com`, not `.googleusercontent.com`.
No one does that though. The latency would be significant.
I currently tarpit traffic from AWS, Azure, GCP, etc. since it's not like any of my real customers have their PC inside those networks. (I then use that for experiments with providing bogus data to AI scrapers.)
Doesn't do much to help with the "VPN that uses random consumer PCs and phones" traffic.
How do you tarpit GCP if Google’s search engine scrapers scrape from their own cloud?
Google’s scrapers very explicitly identify themselves and come from unique netblocks.
Most our sites don’t need to be in Google anyway.
Won't this harm SEO? What about agentic software suites where authorized users should be able to drop an app passkey into grokbot or such?
"Yes, but who cares" is the sentiment.
true! but how does one find all those ips?
That’s pretty easy - all major providers have public lists of IP ranges, usually as json files.
Just ask RIPE
>But I don't see that happening.
Then you are not looking. Already have to switch to resi proxies from time to time when encountering yet another smartass who decided to play security theater and block datacenter ips on his shitpile he calls website, because "OUR USERS MUST BE GOOD BOYS WHO LOVE TO LIVE UNDER SURVILANCE AND ALLOW ISP TO TRACK THEM 24/7" (and before you say something like "others can track you too!", your ISP has the ability to knock on your door, they should be given as little information as possible, let them do metadata analysis on per-person basis if they really want it, but no 1-click mass surveillance shit).
If you are valuable, you will be be scraped. Turning user hostile in a hopeless endeavor to "protect yourself" is not the solution.
I can see that you're having strong emotions about this, but that rant is just hard to read and serves primarily as venting and not really to convince anyone of anything.
Unless one zooms out and thinks "okay, these guys seem to react negatively if we do exactly that. We should do more of it", which is probably not what you want.
It's hostile to you personally, but I wouldn't call it "user hostile".
Blocking "scrapping [sic]" is also not security theater, you misunderstand the intent of GP.
Anyone who thinks blocking datacenter ips helps with blocking scraping is a clown.
It does, measurably. A massively popular site is going to get hammered with more advanced types of scraping, but they're going to have a team that can more easily mitigate it.
A site that doesn't care about corporate users basically loses nothing.
exactly, there are lots of other more effective ways to block the likes of you
Let's hope you enjoy killing your real userbase with collateral damage, because that's the only thing you are going to accomplish.
I trust my ISP far more than I trust bigtech. The downside of connecting from my ISP is that the site I connect to can fingerprint me trivially from the IP range
I'm sympatic to open3dlab but I think the focus on adult-content is just trying to spark outcry for cheap.
It has been shown times and times against that removing adult content from the training source (at least for diffusion models), results in generally lower-quality output, even outside of adult-content, particularly in terms of representing human bodies.
would the implied intent (from the inclusion of adult content) of training models on open3dlab content, without asking them, render Roblox's actions _less_ antisocial???
The current AI Ethos is morality is just another obstacle on the way to their IPO. ...Lets just hope after they get rich, they stay away, and dont bother us with books, videos and conference speeches on entrepreneurship mentoring...
hi jared
They should change their name to openish3dlab.
Or specify that it's "open" as in "OpenAI" (i.e. not at all), not as in "open source".
Not really. Given that roblox is almost entirely children, and given the amount of hot water they're in you'd think they'd stay the hell away from adult content
You'd think! But they don't. Roblox is also notorious for tolerating a ridiculous amount of grooming.
Discord knows I'm an adult and keeps trying to send me "promoted Quests" to go use Roblox. That seems sketchy to keep baiting adults into childrens' spaces, too.
An adult who plays Roblox can spend much more money on it than a kid getting some Robux for Christmas
There are several surprisingly good horror games my daughter likes to play with me.
Roblox is mostly trash content form my perspective, but there are definitely gems in terms of playability.
The number of young adults (18-30) who still play children's video games has always been astonishing to me. We live in a Peter Pan world these days.
Roblox has lasted so long because it's not a specific game which is only relevant to a particular audience, it's a platform for whoever the users are to create and share games/content with others.
I never really liked it because of the virtual economy aspect, but the only link between Discord having quests on Roblox or adults playing Roblox and kids is that's the majority of the userbase and therefor content, not that it's only for kids.
Couldn't the adult file download just as well be used to train a model that rejects adult uploads to roblox? I don't see the outrage.
The model can check if Hotdog. Or not Hotdog.
if you put stuff available to download, dont be surprised that someone will download it
What is the actual news here, can anyone explain ????
They didn't do it in the intended manner.
> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.
> did not respect our robots.txt
I don't see a problem
> ignored our Terms of Service
ban them from the service then and case closed?
> and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only
because it's been proven they have been used commercially?
I do. It's wrong to ignore a robots.txt.
The fact someone else may have licenced content for commercial use doesn't entitle someone else to do the same without paying for it. That's the whole point of copyright law.
> It's wrong to ignore a robots.txt.
It's not nice. It is, however, not illegal.
And before you agitate against that, think deeply about the consequences. A world where website owners can legally dictate exactly what software you use to access their content.
They didn't say illegal, they said wrong. And they were right. You even agree with them by saying "It's not nice". Non-nice things are wrong in some way.
And, we already live in a world where website owners can legally dictate exactly what software you use to access their content. They can require that you log in with specific browsers running specific software on your computer, they way online schools run exam proxies.
We do not in fact live in that world. It is not illegal to violate the terms of service of a website.
A website can block Xyz user agent, put Xyz in robots.txt, or even put "No using Xyz!" in a popup and you cannot be prosecuted for using Xyz. It might be hard for you to evade their requirements, but it's not illegal.
Whether or not it's wrong is a matter of opinion. Yours differs from mine, that's fine.
It is illegal to download copyrighted material from a website and make copies of it in violation of its licence.
I can’t go scrape New York Times articles and make copies of them without first licensing them from NYT.
Wrong != Illegal
It is wrong to pretend you are deaf to get out of an awkward conversation. No one is going to put cuffs on you for that.
Okay then, how about this:
Ignoring robots.txt is not wrong. That's my opinion, just as valid as yours.
It also happens that the legal system agrees with my opinion of the wrongness of this act.
Also, you did say this:
> where website owners can legally dictate
Which is, as I pointed out, false.
The copyright terms on my own site make ignoring it and scraping it expressly illegal.
Unless copyright law has been entirely repealed?
US case law may not be on your side there. Generally unless you require a login to access the site (and even then you can only really ban for terms of service rather than recover damages unless they hacked around login requirements) judges have found that using scrappers on publicly served data is fair use. It gets murkier with creative content (rather than straight data) in what they can do with it after scrapping but the scrapping itself would still be 'legal' in the they can do it without judicial consequence sense.
It's one of the reasons why sites that served a lot of data used to have APIs or back channels to get that data even if they technically made money by serving ads on pages of that data, because they were going to get scrapped no matter what, so having a legitimate way to get data that behaved nicely with the servers and was nicely readable by requestors was win-win or at least not lose-lose.
The news is that people download it so much that they saturate your server’s connection and/or peg its CPU or disk (whichever is the weakest link in the chain). We used to call this a Denial of Service attack but now it’s apparently just a cost of doing business, even for people who just want to run a non-commercial hobby site.
its not a denial of service because there was never an intent to deny the service
The effect is a denial of service. Service is denied because the server is overloaded. The intent is at best callous indifference and at worst is copyright infringement.
It’s comparable to broadcasting radio interference as a side effect of some industrial process. If a company were to do that they’d be slapped down hard by the FCC. The unfortunate reality we live in is that we have no equivalent regulation on the internet. Thus the situation has become a tragedy of the commons: small websites suffer denial of service due to unsustainable and unwanted bot traffic.
https://therecord.media/linkedin-wins-court-order-blocking-m...
Which is it then? Megacorps can enforce their TOS through the law but small companies cannot?
Man if only there was such a thing as good manners, good behaviour, accepted practices from a community to not massively hammer servers. If only these websites had been up for a decade with very few problems, before a notoriously manipulative, lying, deceiving, abusive company that makes money off of child abusers came in and just went hurr durr free data in the WORST possible way instead of just politely asking for a dump.
Internet is untrusted network, there are a lot of malicious and gray actors. There is no community here.
it is in fact engineering incompetence and loose engineering, if you cant handle a burst of traffic
"Leopard ate MY face" ?
The entire article points the finger at "roblox" as an entity, but the behavior seems to indicate it's just an individual doing the scraping - possibly not for corp use.
Look at the timelines - this scraper was running on someone's laptop: it turns off when they shut down for the weekend and lunch.
It's certainly possible, but I'd say the evidence fits the opposite explanation more: if it was not for business purposes, why do it on your work machine, during working hours, with your work email address in the User-agent?
3$ in outbound traffic on a public service, how is this news?
I mean, it's not the size of the download, it's the unauthorised scraping of community assets strictly against terms and ignoring robots.txt by an American corporation. Resource of a kind that used to get kids threatened with spending most of their life in prison.
But I agree that this kind of theft by US corporations is no longer news.
(Yes, it's theft: they were aware they may not do it and according to the article attempted to get around further restrictions. I mean it's literally even theft of the $3 you mention — you don't have to be in possession the $3 to illegally deprive its owner of it under common theft statutes)
Aaron Swartz pulled down by the legal system for trying to get things accessible for people instead of being blocked by profit requirements.
Companies copying things to make profit for themselves not being held accountable.
Progress is one thing, injustice is another.
Scraping of assets from a site that encourages and where staff explains how to and posts scraped assets? Color me sympathetic.
Scraping is legal, last I checked. If you don't want people downloading your content then don't host it.
maybe stupid question but how is it possible to not be protected against supercrawlers like this, when you own large amounts of data, specially if all requests are coming from the same server ? Aren't cyberprotection services like CloudFlare work against this kind of "attacks" ?
"supercrawlers like this"
then in the post "It came from a single Amazon Web Services (AWS) address. It had read the main page of 18,926 projects, which is practically our entire catalogue, in 26,429 requests over a span of 34 hours."
sounds like some R&D dude running solo to be honest, nothing about that is a supercrawler lol
Yeah, I can imagine it being a problem if it was from different IP addresses, but surely putting a limit on requests from a single IP would be a straightforward fix? Although maybe until it happens, you don't think about it.
> cyberprotection services
These services cost money. Scrapers also cost money in terms of resource utilization and downtime. There's always a tradeoff.
The ROI of services like Cloudflare bot protection, Datadome, HUMAN, AWS bot mitigation etc. is highly dependent on your income from the data. In the case of publicly hosted freely accessible data it can be hard to justify.
Just clicked a random model on the site and it is licensed as beerware. If you like it and meet the author, you should buy them a beer.
Sounds like Roblox should open a open3dlab bar!
If that data is at all important, why is is downloadable?
This is quite simple put in the article.
> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.
A robots.txt file is not anything, not enforceable, it's politeness. Of course it was ignored.
That fight was already lost back in 2024.
Sue them. They'd sue you for ignoring their ToS.
It's a community site, first model I looked at (Tanya by Shrimport) is under CC-BY-ND-NC licence (Creative Commons, By attribution, No-derivatives, Non-commercial).
AI training by definition is derivative, and Roblox not using it for commercial purposes if used in production is practically nil.
This is a huge part of why AI upsets people, we can't have nice things such as communities where people are sharing 3d models without it being feeding ground for commercial companies that has little intention to ever honor any licences or compensate authors.
If courts say that training models is fair use then copyright and license terms are moot.
It’s not fully played out in the courts yet, but so far doesn’t look like it’s going to be enforced how you want it to be.
Except someone can explicitly licence their content saying "this cannot be used for training models, or you're violating the licence you used to download it in the first place".
AI training is considered inalienable right in certain jurisdictions.
If you expect visitors to ask before downloading your content, making it simply fetchable with HTTPS on the open Internet is a bad way of implementing that requirement.
You need an actual workflow where the visitor has to initiate asking, and then wait for the request to be reviewed and granted.
There's a dedicated furry toggle? I mean... I've heard of this but, now I feel like I really missed some societal shift in the world.
Wait 'til the 2030 census
[Username unrelated]
So, where is your security? After 145 gb of stealing you started your blocking? Rate limitation should be automatically enabled instead of waiting and inspecting the traffic.
Honestly I don't see the issue at all. So long as your infrastructure can handle it and there is no cost to you it should be fine.
The only proviso is that you should not be able to block distillation on your models you trained using others data.
I also don't appreciate the sensational framing of adult content here, it's purely meant to appeal to irrational emotions. We all know how models train, input and output are very different things here.
I wonder at what point the Roblox kids all reach 18 years old, and Roblox can pivot them all to a separate adult version thereof...
Never, it gets new players constantly. This is like saying I wonder when YouTube is going to turn into Pornhub
> This is like saying I wonder when YouTube is going to turn into Pornhub
To a certain extent, it already has. YouTube for Kids and regular YouTube are worlds apart.
Robloxs original player base is their 20s now and still play.
You know there are new kids being made right..
New kids often don't want to be in the same space as where the "new adults" are though, that's uncool. See: literally any social media site since forever.
AI is industrial scale theft. Like if someone else did this we'd be looking to courts to sort this out.
145GB is hardly small. How does something like this even happen? In more ways than one.
These foundational models are just getting curious now that they are entering puberty.
I love that the scraper took a break over lunch. Just someone hitting pause on scraping gb's of Zelda models to get a sandwich and then firing it back up.
Fixating on the adult content is weird. Why make so many moral judgements about what Roblox is or isn't doing with the data? It is trivial to run a script to filter out stuff that doesn't meet your standard after you download it. You also need a ton of adult content to train classifiers that detect and remove adult content.
Farming outrage by implying "Roblox is downloading adult content to show to kids!!!" with zero proof is pathetic.
It's entirely plausible to me that they could be training an NSFW 3D model detector, specifically because of their very minor userbase. TFA seems to presume it's all being used to train genAI, in exactly the same fashion.
We know NSFW data pollutes many otherwise non-adult datasets, so genAI is going to be trained on naughty stuff inadvertantly regardless - they might need a smut neuron specifically to turn off that sort of output.
Or they are just being irresponsible. point is, we dont know.
It's still a tad icky to scrape tons of data without asking, and downright rude to ignore robots.txt and ToS, but that's the world we live in.
I have a friend who was working at Roblox on in house classifier evals on texture generation (I think they were working with some enterprise version of Stable Diffusion?), specifically on adult content filtering and protected IP replication. That company seems predatory in many ways to me, but I'm pretty sure they aren't intentionally giving kids the ability to generate pornographic content on their platform.
Because of the implication
I assume they need the adult content in order to detect adult content generated by their users.
The internet must understand one simple rule. What’s downloadable will always be downloaded. There are plenty of people who don’t give a flying fk about your LICENSE.md, robots.txt, ToS and whatnot. It’s like leaving your bike unlocked in the public. Even if there is a giant cardboard next to it saying: “please, don’t steal the bike” - nobody cares. Someone will strikethrough the “don’t” and grab the bike.
I know it is an unpopular opinion, but if you do not want your content to be scraped, you have to put it behind payment walls and copyright it. In Germany we have decisions from the highest courts that deemed websracping perfectly legal (it was in the context of a competitor scraping airline ticket fares).
They ignored the licenses, so kinda moot point you're making.
And how were those license conditions violated by downloading? Their are permissive in the first place, and violating without passing on to a third party is almost impossible.
Were they used in a commercial context when a commercial entity downloaded it?
If yes, they were in violation of the license. Fyi, that's explicitly stated in the article we're commenting on.
Supposedly they are, that is enforceable how? Download is not anything. Training AI on them is not anything. Using the trained model is not a violation of the terms just because you think it should be.
i see. as long as i can download Software that is made available for free for students its completely legal to do so and use them commercially as a non-student, after all its freely downloadable.
good thing you explained how copyright works legally, almost spend my money unnecessarily.
COPYright becomes relevant once you COPY something. As in, give it to a third party. I don't see any third party involved here. The download itself is not subject to copyright - licensing terms may or may not apply - and just because the license text says something doesn't mean it holds up in court.
Til you can download something without copying said something.
Wouldve been great to know for people that have been found guilty after downloading illegal and unlicensed content.
Fyi, the nation you mentioned (Germany) adheres to a much stricter concept called Urheberrecht. Under this regulation, you're actually in even more legal trouble. Though Roblox ain't German, so kinda irrelevant, admittedly
German Urheberrecht explicitly states, that downloading something is legal, if not downloaded from an obviously illegal source ("offensichtlich illegale quelle"). Thats why it is perfectly legal to download copyrighted music from youtube (because Youtube is obviously NOT illegal). Youtube ToS are irrelevant in that case. You are however still not allowed to copy the data (music) to a third party (that is when copyright starts).
Whether or not the file you downloaded was even allowed to be uploaded to that website, is irrelevant in that case. Then the uploader and provider are liable, not you the downloader.
> Urheberrecht explicitly states, that downloading something is legal
Technically right with your phrasing, but wrong considering the context.
That exception is explicitly about the fact that eg pictures served on a website will be copied to the local cache and can still be shown without violating it. But besides that, nobody argued that the download itself was the license violation.
If Roblox only downloaded and then deleted it without using it in any way, they'd not have violated the license. Was that the point you were making? If so okay, that's true but from my perspective a pretty stupid view. Surely you're aware that they didn't?
Incorrect.
Yes, as of now, you can do exactly what you assume that Roblox did. How is this still surprising to people?
How do you know what context it was used in?
If it’s fair use, the license doesn’t matter.
It's beyond fair use, it's statutory exemption to copyright and data protection in certain jurisdictions.
Tons of those are (as the site admins admit) models that are themselves infringing on copyright, and thus any license based on copyright ownership is invalid.
You can't enforce a license on a 3d model you in turn stole from a game.
Just to make sure I understand you right: the argument is that
Acteur a has a no permissive copyright
Acteur b has a non-commercial copyright on a model that infringes on a's non permissive copyright
Acteur c now can freely use it commercially, because b's copyright notice is invalid as it was never in a position to grant a permissive license
The stuff you learn on HN is truly breathtaking.
Thanks for clearing that up, that opens up a lot of avenues for future developments
No, it means that Actor B has no copyright at all. Copyright requires ownership, and a thief has none. So Actor A (e.g. Activision) can make a copyright complaint against Roblox, for their 3D model that Roblox now has, that Actor B was illegally hosting. Actor B can't say crap.
The great theft.
It is so cool
145GB isn’t much. It fits in RAM in some computers.
145gb of ram? Check out Mr. Moneybags over here!
Ram used to be cheap.
They don't have to ask, it's on the web, you (open3dlab) published it.
Who runs that site? A pre-schooler?
As an artist, there is the temptation to hoard my works like Smaug on his hill of treasure. But I got past that in a moment of weed-inspired revelation : I am the fruit-bearing tree. Therefore my wealth is infinite. In fact every fruit I bear is better than the last. So giving it away is not such a biggie. And clutching it to my breast like a boney vampire is in fact detrimental to my process. I put great faith in the process.
Have you seen the price of gold vs. the price of digital art?
Like, per-ounce?
I'm not even impressed..
I'm just to ignorant to this in context of how the reality just works.
Downloading content on the web is what the web is for. Using the data for training is something lawers need to figure out.
open3dlab should spend the time and energy, as unfortunate it is, to sue them to get this resolved.
Ablog post about this is basically 0 information. The stories about soooo many bots now crawling the internet and creating a lot more traffic is going through news and hn for month.
"oh no, not the creative commons resources we distribute freely even if they contain copyrighted material!"
Look, I'm usually pretty sympathetic when people complain about drive-by AI scraping like this, but the amount of pearl-clutching here is exhausting.
Yes, it's a game for kids. Yes, the company that makes it just scraped up a bunch of adult content. No, that does not mean they are going to give adult content to children.
Whoever wrote this was aiming to be as aggrieved as possible. It's performative, and I am having trouble taking it seriously.
So what? You made your content available and someone downloaded it. Why is this even notable?
Would you also say that general licensing is irrelevant for everyone?
Of course not. But there’s no indication whatsoever that any license has been violated. Downloading a file from a free access server cannot violate license terms.
Fear that something will happen is not the same thing as evidence it has happened.
> Downloading a file from a free access server cannot violate license terms.
Sure it can. If you're downloading it for commercial purposes (clearly the case) you're violating the license.
Legally speaking, it is extremely well established that downloading is not the type of copying that “copyright” concerns itself with. And the GPL and similar licenses are predicated on copyright laws.
Once you make the content available in some other way, then copyright law might have something to say.
People in tech used to make fun of “you wouldn’t download a car”. It’s sad that so many have reversed their principles the moment a convenient villain shows up.
If only you could read the article and see that the vast majority of the assets are licensed under a non-commercial clause.
I guess we'll never know until you learn to read anything other than sheet music.
Can I scrape all GPL source code from github. Then use the code commercially and then say so what, they made their source code available to download?
Did someone do that in this case? I don’t see any indication let alone evidence that happened. And I don’t think it’s likely that it will.
Let me refer you to my earlier distinction between things that have happened and things you fear.
You may remember from 2021 that Microsoft's Copilot would gladly regurgitate the GPL-licensed Quake 3 source code, without giving you any indication it got it from there or that the GPL applies.
https://news.ycombinator.com/item?id=27710287
https://x.com/mitsuhiko/status/1410886329924194309
Ok, so go yell at Microsoft about that incident instead of speculating about a different party doing a different thing.
> Can I scrape all GPL source code from github. Then use the code commercially and then say so what, they made their source code available to download?
Yes, that's the whole point of the GPL. Use it however you want, but don't restrict the next person
Oh, it would be so nice to force the Great Thieves like "open"AI to release their weights on GPL license...
Right now, its legal to use this data to train a model.
Which is different than using the data 1 to 1.
I think technically such a model should abide by the licence of the inputs, hence all models would probably be GPL if the FSF had resources to fight it and the legal profession had an inkling of the processes involved.
Or maybe the FSF is just waiting for everyone using AI code to become hooked and then subpoena every Antrophic/OAI/Codex customer and force the most massive source release in history (If Adobe/MS would file lawsuits vs the Craft apps and with their resources create legal precedent it could create chaos, maybe the only part stopping them right now from filing lawsuits is them realizing it could backfire since they're heavy AI users themselves).
But as far as i know GPL does not prevent you from using it for training?
No, the question is, if the GPL'ed code/structure is more or less recovered during inference, would a court rule the result to be covered by the GPL?
I know there was some cases in the past where people swapped licences and changed variablenames,etc but the essential code clearly remained.
Yeah for sure. But then the question becomes weird: If its binary equal (like asm) but nothing else, will it hold up?
Im quite aware of software patents, i never had to use some software patent scanner in our compliance CI/CD.
So it might be a real issue no one can or does enforce?
A while back I was thinking it wouldn't be enforced, but the entire Craft-clones and REA tools usage explosion kinda hints that disassembling/rebuilding the source is cheap enough that LLM's(ironically) could probably quickly find culprits if you had suspicions about certain apps.
Not a lawyer, are you?
Does it matter? Lawyers don't know either since most majorer cases are still in progress.
So far it seems more cases that have been decided in lower instances or has been settled or gone in the direction of the party with most money for lawyers, still even in those cases there seems to be a slight tilt towards rightsholders.
I'm not saying anything categorically, but if some cases go all the way and towards rightsholders, it could become a real shitshow in the software industry since we've adopted AI so heavily and the non-significatng portion of public GPL licenced code could bite people in the ass.
Yeah, it does matter. This:
is vibes baloney.> Some examples include models of Eve from Stellar Blade, Mei from Overwatch, and a Horse cock dildo.
I don't know what's more wrong: that a dumb model started downloading "Horse cock dildo" 3D models (to which end? to stuff that virtual 3D "horse cock dildo" in its own virtual LLM ass?) ...
Or that there exist "horse cock dildo" 3D models.
Seriously in which world are we living?
And I should be thinking about the people who designed that horse cock dildo and care about them? And those viewing those/using those? 3D printing those maybe? And I should care about the retards who can't even prevent their crawler from downloading 145 GB full of horse cock 3D dildo models and the like?
Nah. Fuck that, I care about my family and you're all on your own.
You obviously don't own a horse cock dildo
Everyone should be hosting a poison fountain and pressing thumbs down on models when they provide really good answers.
Who actually cares? Isn't the whole premise of the AI revolution just gorging ourselves with other people's data so we can have AGI? I was under the impression that we have accepted this sacrifice with OAI and friends leading the way.
People really still buy into that framing? I think it's pretty clear that it's generally just about money as it has always been.
Tech is full of rubes that eat up the lies.
Crypto, big data, AI. It's all just another middle man hoping to scrape some joy out of everyone's lives to they can put a price tag on it and sell it to rubes and the government(and rubes in the government).
Who's "we"?
If the authors of the data are paid...ok. and not just the biggest players - every single one. But they are not.
Sam, pay this guy for his shitposts please
"we" in this sentence is really a handful of encloistered silicon valley weirdos. Most people do not like it and have no real say in the matter.