oasisbob

I'm not sure all companies will have deniability. It's pretty easy to see companies which are trying to evade detection or misusing their existing spiders for AI training purposes.

Some examples I've seen have crawlers which mask themselves 99% of the time by faking Chrome, but which will leak their real identity in UA strings which share the overall fingerprint of the swarm.

(I'm looking at you, Replit.)

I care a lot less about this issue as a matter of intellectual property than one of capacity consumption and cost.

You have large VC companies evading rate limits and other restrictions and they're causing real economic harm through their actions.

You're slicing the meaning of UA strings too fine.

Bots can easily identify themselves through REP in RFC 9309. This isn't difficult or confusing.

Someone who is using a residential proxy network, headless browsing, and/or TLS fingerprint manipulation to evade rate limits and other controls to issue large volumes of automated requests under a deceptive UserAgent string isn't difficult to describe and differentiate versus a normal user using a UA.

The proposed text of the bill is rather straightforward. It turns more on the "stealth" bit than "bot".

(a) Prohibition.—A person may not—

(1) deploy, direct, or cause to be deployed, a stealth bot to access a website, digital platform, or online service in a manner that is reasonably likely to damage, impair, or burden the technical or commercial operation of a website or other internet service; or

(2) intentionally misrepresent, conceal, or obscure the nature of the bot to appear as a human user for use in connection with a generative AI model or service.

(6) STEALTH BOT.—The term “stealth bot” means a bot that accesses, retrieves, scans, indexes, scrapes, or otherwise interacts with a website, digital platform, or online service without prior disclosure of its identity and purpose, in particular by—

(A) failing to identify itself including through a valid and accurate user-agent string; or

(B) failing to disclose the specific nature and purpose of the bot, including any proposed use and purpose of page content (including text and data mining, search indexing, inferencing, artificial intelligence development, support, or operations (such as training, fine tuning, retrieval augmented generation)) or other automated processing at the time access is requested and in a format that the website operator can access.

I think this one is really localized.

Some places do have really well built out platforms where logging, instrumentation, databases, deployment methodologies, IaC, etc have well-built happy paths that exclude a bunch of accidental complexity.

I think a lot of other places are either too small or grow too quickly with the wrong set of values and admit too much into their "platform" which had very little design to begin with.

Given the amount of progress the CAB forum has led in the last decade+, I'm not sure I agree with that diagnosis. Plenty of people in the forum I can think of who have forced positive changes due to the strength of their experience.

If anyone should be navel-gazing coming out of this incident, surely it's the trust store maintainers. If there's a big concrete improvement to be made, short of burning down the web PKI ecosystem, I'm not sure it's obvious yet.

The annoying thing is that everyone thinks they're big enough to force their own TZ.

Southwest airlines does it.

Rackspace used to do it, to the point of needing to ask them pretty please stop provisioning hardware on central time. Obnoxious.

SCT enforcement falls to the client though, yeah? What's stopping someone from signing a rogue cert silently which is accepted by CT-lenient clients?

My vague and inexperienced read on their description boils down to "we were doing something weird and non-standard as part of our key ceremony because we intended these keys to be exported, and because of that process weirdness we blundered and gave the HSM faulty instructions."

It's been a while since there was a good CA death penalty case.

Given Wayne's hints in the timeline that this issue was discovered by an agent, it might be one of the first big corporate death sentences due to AI?

> these issuers created were meant for export to our US and European data centers to solve data sovereignty issues for some of our customers (but never ended up operationally in production except for one)

This bit sets my hair on fire. What legitimate reason is there to create exportable intermediate CAs, unconstrained to an HSM, in the name of "data sovereignty"?

Source? That would be an incredible blunder, but that also appears to be the kind of URL one would expect to find certs at.

I'd be more worried about the site with one fridge cutting corners than the one with 50,000.

It's the complexity of the world which should drive you towards keeping this stuff offline.

Hell, I used to manage some VoIP switches which would hard-lock if you hit them with `nmap -A`. More people need to learn this lesson.