Roblox downloaded 145GB models from us (including adult content) without asking
j / k
|
Down or up a comment |
h / l
|
Previous or next link |
?
|
This help |
Personally, I'd never build on top of Roblox itself, but... and I hate to say this, if they made a generic 3D service that let you export to any game engine, I think I'd pay Roblox for said tool if it was good enough, which, they have so many games and capital, I could see them pulling that off, I mean they already have a base model.
I would love to see more text to 3D model models that can wire up straight to a game engine, I think we'll see a lot of interesting things, like children prompting the worlds of their imagination into reality, and the 50 million memes that will plague social media.
Same, but none of the models actually have good enough output yet to make that work. Currently they're all aiming to "fake" the niceness by doing modeling+texturing, but when you look at the wireframe, it's pretty clear they're very far of from being usable, even less so in a game where performance matters a great deal, and you can't just YOLO assets however you want, which is what the "text to 3D" models like to do.
Inevitable that we'll get there eventually though, it's miles ahead where it was just 1-2 years ago. I guess my point is that it's not the "3D model > game engine" that is lacking at the moment, but "text > 3D model" that cannot produce high quality enough results.
One weird thing I run into is, I can have Claude make some interesting things with threejs, but translating it to other engines isn't always so great, and its usually raw code. I'm not a 3D guy, I just want to get up and running with things I can code / think of.
https://en.wikipedia.org/wiki/All_models_are_wrong
How’s that for a throw back
Lmao!
I'm not gonna comment on the morality of mass acquisition of all of this data, but as someone who deals in 3d in the medical/dental space everyday..
there's absolutely no doubt that all of that data is as valuable as gold in research.
On a tangential but related note..
I mean, people in possession of troves of data, especially in the medical or 3D industries, really ought to start understanding the value of the data they're sitting on. You can give it away if you like, but don't be upset when someone turns it into a couple hundred billion dollars and doesn't compensate you.
If you won't like it if tech companies rip you off, then take the legally required steps to protect your data. (That includes making sure you licensed your data properly. And protecting your data with explicit use licenses and, potentially, even access controls.)
https://open3dlab.com/project/e2a0830d-f166-4b1b-aabf-8ca735...
Just an example, there's plenty more on the frontpage.
I have nothing against these guys, but I just can't understand the moral high ground of the complaint.
> We'll be honest about where we stand. We don't like copyright as it exists. We'd like to see it radically reformed, and we wouldn't mourn it if it were abolished. Our community lives in its grey areas every day: many of the models on our sites are fan ports of characters from commercial games, made out of love and shared for free. When a studio sends us a takedown notice, we comply.
> While we as small artists and fan communities get copyright used against us, the world's largest companies are committing copyright infringement at a scale unseen in human history. This has been the case since the invention of the internet of course; digital media make duplication, remixing and resharing trivial, but copyright law never caught up. Filesharing stabbed copyright in the gut. AI is just twisting the knife, and completes the creation an unequal system where copyright infringement is only a crime if you're a low net worth individual.
Rich companies are infringing copyright at industrial scale in order to build their LLMs, and even if caught and challenged, they don't suffer any catastrophic punishment. The infringed party gets enough money to shut them up and everyone moves on. A fine is a price. They'll keep doing it with impunity. Meanwhile the small guy who doesn't have copyright lawyers on retainer is getting shafted, time and time again.
Also, "fan ports" is doing a lot of the heavy lifting. They're assets extracted from commercial games, uploaded with whatever license the person who extracted and packaged them chooses.
From their argument, if they truly think copyright should be abolished, an LLM capable of remixing that work into whatever you want would be a good thing, right? Ultimately this would empower the end-users of the models.
There's an argument to be made that these models trained on the world's knowledge shouldn't be locked behind closed models controlled only by big corps, but in this case it's good that anyone can download data and train such a model, right?
I can't speak for roblox intentions, and I am well aware of their history. But so far they seem to have published at least some of their model work to HuggingFace: https://huggingface.co/Roblox/
What nuance am I missing?
And the same thing is happening here? They’re hosting copyrighted materials and have also not suffered catastrophic punishment.
There’s a substantive difference between ingesting other people’s work and hosting copies of fans knockoff models of their favorite characters.
It’s even weirder because in other mediums this wouldn’t even be a thing. Nobody gets nearly as up in arms about fans doing their own cuts of movies, or re-using characters in written fan fiction, or etc. Very odd to me how up in arms people get about this specifically for visual art.
Or am I misreading the situation?
Well I don't! Copyright is a farce and I continue to wipe my butt with it.
Just because individuals aren't an enforcement target doesn't mean enforcement isn't happening.
Are you sure you replied to the right post? You're agreeing with me here.
The post I replied to is the one suggesting that us little people doing this is at least as bad as rich people and rich corps doing it.
Honestly people need to wake up to this industrial level theft, and get some laws in place. If someone did this by hand you'd call it either a DDOS or IP theft, even if license is permissive. Just cos its from a machine doesn't excuse.
Straight up theft, not fan recreations, theft.
https://www.youtube.com/watch?v=MidugiRfHaY ("Ripping Encrypted Unreal Engine Models" | Open3DLab)
(Found via a sidebar ad on their webpage).
It's not rare that these assets cost in ranges of $10k and made in less than dozen man-hours each. They're not harvested and collected, but artificially created by individuals by work orders or as their own projects. A lot of these conversation feels like people are talking about something similar to Louvre collection items that cannot be obtained other than by somewhat illicit means, leading to discussions of which illicit means will be tolerated in the name of preservation.
No, it's something they make as we speak on Blender. Like with a mouse and a keyboard, or sometimes with a pen tablet. I think the anglosphere Internet hasn't yet reached the point where justification of dubious means can be discussed; we're at the phase where it should be educated to people more often that these are man-made creations that each has economic values.
Without more widespread recognition about how these models, arts, games, etc., are artificially made by humans, and not magically discovered, I think discussions as to how they should be handled will be always a bit off, whichever way it would go. That's my point.
I'm not familiar with their site; I assume it's user-uploaded? In that case, it's the same challenge that every user-generated content site has, balancing openness with policing IP violations.
Again, I don't have any particularly strong issue with this, just with the pearl clutching regarding roblox downloading the data.
Party B: massive IP business , very aggressive about everything from brand to software, defends and monetizes current copyright regime
I think it’s fair for party A to call out party B for downloading a massive trove of known-copyrighted material.
Ofcourse AI providers very much DO want to make money with their trained models.
https://open3dlab.com/project/0a4538ba-00df-4f6d-b3e3-14d978...
Theft is the action or crime of stealing. The fact that some definitions include the concept of "with the intent to deprive the original owner of it" doesn't make digital theft not a theft.
Also, it could be argued that the theft of the IP is further substantiated by the loss of future potential revenue from that IP, as, after all, why would anyone pay the orignal owner and creator actual money when an AI agent will make an exact duplicate of said item and possibly further customize it for them as part of its already paid for product catalog?
If the purpose of every argument is to prevail, then sure, invoking morals in any discussion can seem like a tactic. Moral hypocrisy can be particularly exhausting.
If the invocation of morals is always evidence of manipulation, though, then any ethical position can be easily dismissed.
Moral hypocrisy is cynical. But that doesn’t erase the value of morals and ethics. Morality, sincerity, and rhetorical effectiveness are still very different things
You cannot use a moral high ground unless you’ve earned that high ground through your past behavior.
more radicalization towards AI
I think the spark came from some other HN comment I saw? So thank you for that, whoever wrote that.
That alone is not a sufficient strategy of course, but you can get rid of a lot of bots by just refusing to talk to where they tend to live.
Of course, if everyone were to do that, they'd eventually pivot to residential proxies. But I don't see that happening.
https://news.ycombinator.com/item?id=49491791
None of these measures alone are a full solution, but if you stack a bunch of cheese slices, eventually, no holes line up anymore.
In the sense that you do not have people that actively sell those services via their home internet connection.
The whole thing just exists because there's this whole predatory ecosystem that uses malware and malicious devices to sell that without the owners even knowing.
That makes it legally questionable, even though I guess technically it is legal enough? Still radioactive, so as a serious business, you do not want to be seen doing that.
If you try to use a normal VPN, you get rate limited or blocked everywhere. But if you switch to a residential proxy, all those problems go away.
To be fair, if all you're doing is torrenting or similar copyright infringing actions, then a simple VPN is sufficient. But if you want to do web stuff, you gotta use a residential vpn. Not much way around this.
The point however is that this is crime and crime is incorrect and fundamentally shouldn't exist.
But, more importantly, as a serious business, you do not want to be seen doing crime or benefitting from crime or supporting crime or being near crime. At least in a working society that is.
Secondly, it's only for-profit copyright violations that are a crime. But as OFCOM learned the hard way, stuff illegal in the US can be legal elsewhere.
Thirdly, for some fucking reason, the US AI companies are immune to criminal statutes of for-profit copyright violations. Job creators, or some bullshit.
And I'm not sure exactly why you're so dead-set on "crime crime crime". It's all politics and manufactured criminality. And well, I don't particularly care if backing up my movies to a Jellyfin and sharing access is "ill eagle".
The AI companies are bulk pirating AND then selling that access.... But I'm the criminal? Fuck that noise.
Which then was countered with a broad range of classic HN dysfunction, hostility and pedantry.
When the truth of the matter is that it's actually just a decent idea for some use-cases and a less-decent idea for others.
But instead of acknowledging that nuance, an explosion of nonsense happened here.
I genuinely do not understand why you've suddenly started talking about yourself and your own residential proxy use? Why does that belong here?
Either by technical means or by a whistleblower.
Which might be a gamble worth doing, but also might not. And regardless, the fact that it is a gamble alone slows down velocity.
Yes, yes there is always something. Yes there can always be workarounds.
But that is not the point. The point is that things are made harder. That is the point. To make things harder
Not impossible. Harder
Jesus Christ. It's all just a game of probabilities and friction. One needs to understand that to understand reality.
I would argue that more often than not it might not. Really depends on the specifics though.
A lot of stuff on the web actually isn't really relevant for all audiences everywhere I'd say. It just happened to be accessible by all, because academics back in the day dreamt of a better open world that didn't really manifest :(
it is open and better indeed. open and better for capital - the true, living, flesh-eating god.
Let me tell you, at the business I work at, some of our customers work at a company that uses a commercial VDI service for all workstations couldn’t access our service because the VDI egress was in GCP and we had an AWS WAF rule banning datacenter IPs.
Obviously, we removed the rule because it was doing nothing useful but plenty of harm. Real bots come from residential IPs.
It's really not, unless the only qualifier for that is "hosted by a VC incubator". Most of the people here are here to argue about AI or Crypto or whatever, or read announcements from Nvidia and Google. I would bet less then 1% are starting businesses.
And even if we run with that assumption, one might still be fine. It's a trade-off, but, depending on the target audience, a few lost sales might be worth savings in other aspects.
Do many companies really use azure etc rather than dedicated services like zscaler?
No they didn't. https://news.ycombinator.com/item?id=32337698
That’s probably a decent starting point, but a little older. I am not sure if the situation has changed any in 2026.
Of course, the countries the Jellyfin and Plex servers along with IPTV dealers aren't illegal there.
And sure, your device becomes a residential proxy. They don't make that fact clear... But if you told people, I think for that $100-$200 a month streaming bills go poof is probably worth it.
I remember there being a plague of kodi plugins that worked for that kind of stuff for a long time, and they would die and be replaced every couple of weeks, sometimes they would have malware in them, it was a whole thing.
I think that if you want streaming and want to save money, the best practice is to only have one streaming service at a time. When you get bored with it, shut it down or pause it and move to the next one. It's a pain, but at least it won't infect every device on your home network and contribute to a bot farm.
Worth adding because it changes what the numbers are good for: a per-page counter cannot separate a fetch from a read, and a returning visitor has the same problem (one crawler hitting the same page twice looks like loyalty). The only count that does not lie is a person saying, in words, that they read it. Everything else is a probability estimate shaped like a fact. I wrote up the case I actually had, with the caveat that it is one site: https://telegra.ph/A-count-proves-a-fetch-not-a-read-10-27
https://developers.google.com/crawling/docs/crawlers-fetcher...
(Though restricting the Google UA to only legitimate Google IPs seemingly would break Brave's crawler, though that's their own fault: https://safe.search.brave.com/help/brave-search-crawler/)
https://duckduckgo.com/duckduckgo-help-pages/results/duckduc...
https://www.bing.com/webmasters/help/how-to-verify-bingbot-3...
https://kagi.com/bot
Doesn't do much to help with the "VPN that uses random consumer PCs and phones" traffic.
Most our sites don’t need to be in Google anyway.
Then you are not looking. Already have to switch to resi proxies from time to time when encountering yet another smartass who decided to play security theater and block datacenter ips on his shitpile he calls website, because "OUR USERS MUST BE GOOD BOYS WHO LOVE TO LIVE UNDER SURVILANCE AND ALLOW ISP TO TRACK THEM 24/7" (and before you say something like "others can track you too!", your ISP has the ability to knock on your door, they should be given as little information as possible, let them do metadata analysis on per-person basis if they really want it, but no 1-click mass surveillance shit).
If you are valuable, you will be be scraped. Turning user hostile in a hopeless endeavor to "protect yourself" is not the solution.
Unless one zooms out and thinks "okay, these guys seem to react negatively if we do exactly that. We should do more of it", which is probably not what you want.
Maybe I'm an idiot and it is a bad idea. But also maybe not?
Isn't it good if I "showcase my incompetence and lose all respect"? Wouldn't that be beneficial to people that disagree with these ideas?
Take a big breather and think: « how can I have a nice day? ». It’s not that serious!
I get the frustration, but perhaps changing the target somewhat might be in order here, no?
Why would you just try the insulting harder? Why not pivot to literally any other strategy lmao
I mean I guess this would work on a lot of people here, but three times in a row? Come on man. Skill issue
Blocking "scrapping [sic]" is also not security theater, you misunderstand the intent of GP.
A site that doesn't care about corporate users basically loses nothing.
It has been shown times and times against that removing adult content from the training source (at least for diffusion models), results in generally lower-quality output, even outside of adult-content, particularly in terms of representing human bodies.
Roblox is mostly trash content form my perspective, but there are definitely gems in terms of playability.
I never really liked it because of the virtual economy aspect, but the only link between Discord having quests on Roblox or adults playing Roblox and kids is that's the majority of the userbase and therefor content, not that it's only for kids.
What is the actual news here, can anyone explain ????
> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.
I don't see a problem
> ignored our Terms of Service
ban them from the service then and case closed?
> and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only
because it's been proven they have been used commercially?
The fact someone else may have licenced content for commercial use doesn't entitle someone else to do the same without paying for it. That's the whole point of copyright law.
It's not nice. It is, however, not illegal.
And before you agitate against that, think deeply about the consequences. A world where website owners can legally dictate exactly what software you use to access their content.
And, we already live in a world where website owners can legally dictate exactly what software you use to access their content. They can require that you log in with specific browsers running specific software on your computer, they way online schools run exam proxies.
A website can block Xyz user agent, put Xyz in robots.txt, or even put "No using Xyz!" in a popup and you cannot be prosecuted for using Xyz. It might be hard for you to evade their requirements, but it's not illegal.
Whether or not it's wrong is a matter of opinion. Yours differs from mine, that's fine.
I can’t go scrape New York Times articles and make copies of them without first licensing them from NYT.
It is wrong to pretend you are deaf to get out of an awkward conversation. No one is going to put cuffs on you for that.
Ignoring robots.txt is not wrong. That's my opinion, just as valid as yours.
It also happens that the legal system agrees with my opinion of the wrongness of this act.
Also, you did say this:
> where website owners can legally dictate
Which is, as I pointed out, false.
Unless copyright law has been entirely repealed?
It's one of the reasons why sites that served a lot of data used to have APIs or back channels to get that data even if they technically made money by serving ads on pages of that data, because they were going to get scrapped no matter what, so having a legitimate way to get data that behaved nicely with the servers and was nicely readable by requestors was win-win or at least not lose-lose.
It’s comparable to broadcasting radio interference as a side effect of some industrial process. If a company were to do that they’d be slapped down hard by the FCC. The unfortunate reality we live in is that we have no equivalent regulation on the internet. Thus the situation has become a tragedy of the commons: small websites suffer denial of service due to unsustainable and unwanted bot traffic.
Which is it then? Megacorps can enforce their TOS through the law but small companies cannot?
it is in fact engineering incompetence and loose engineering, if you cant handle a burst of traffic
Look at the timelines - this scraper was running on someone's laptop: it turns off when they shut down for the weekend and lunch.
But I agree that this kind of theft by US corporations is no longer news.
(Yes, it's theft: they were aware they may not do it and according to the article attempted to get around further restrictions. I mean it's literally even theft of the $3 you mention — you don't have to be in possession the $3 to illegally deprive its owner of it under common theft statutes)
Companies copying things to make profit for themselves not being held accountable.
Progress is one thing, injustice is another.
then in the post "It came from a single Amazon Web Services (AWS) address. It had read the main page of 18,926 projects, which is practically our entire catalogue, in 26,429 requests over a span of 34 hours."
sounds like some R&D dude running solo to be honest, nothing about that is a supercrawler lol
These services cost money. Scrapers also cost money in terms of resource utilization and downtime. There's always a tradeoff.
The ROI of services like Cloudflare bot protection, Datadome, HUMAN, AWS bot mitigation etc. is highly dependent on your income from the data. In the case of publicly hosted freely accessible data it can be hard to justify.
Sounds like Roblox should open a open3dlab bar!
> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.
AI training by definition is derivative, and Roblox not using it for commercial purposes if used in production is practically nil.
This is a huge part of why AI upsets people, we can't have nice things such as communities where people are sharing 3d models without it being feeding ground for commercial companies that has little intention to ever honor any licences or compensate authors.
You need an actual workflow where the visitor has to initiate asking, and then wait for the request to be reviewed and granted.
[Username unrelated]
The only proviso is that you should not be able to block distillation on your models you trained using others data.
I also don't appreciate the sensational framing of adult content here, it's purely meant to appeal to irrational emotions. We all know how models train, input and output are very different things here.
To a certain extent, it already has. YouTube for Kids and regular YouTube are worlds apart.
Who runs that site? A pre-schooler?
Yes, it's a game for kids. Yes, the company that makes it just scraped up a bunch of adult content. No, that does not mean they are going to give adult content to children.
Whoever wrote this was aiming to be as aggrieved as possible. It's performative, and I am having trouble taking it seriously.
Farming outrage by implying "Roblox is downloading adult content to show to kids!!!" with zero proof is pathetic.
We know NSFW data pollutes many otherwise non-adult datasets, so genAI is going to be trained on naughty stuff inadvertantly regardless - they might need a smut neuron specifically to turn off that sort of output.
Or they are just being irresponsible. point is, we dont know.
It's still a tad icky to scrape tons of data without asking, and downright rude to ignore robots.txt and ToS, but that's the world we live in.
If yes, they were in violation of the license. Fyi, that's explicitly stated in the article we're commenting on.
good thing you explained how copyright works legally, almost spend my money unnecessarily.
Wouldve been great to know for people that have been found guilty after downloading illegal and unlicensed content.
Fyi, the nation you mentioned (Germany) adheres to a much stricter concept called Urheberrecht. Under this regulation, you're actually in even more legal trouble. Though Roblox ain't German, so kinda irrelevant, admittedly
Whether or not the file you downloaded was even allowed to be uploaded to that website, is irrelevant in that case. Then the uploader and provider are liable, not you the downloader.
Technically right with your phrasing, but wrong considering the context.
That exception is explicitly about the fact that eg pictures served on a website will be copied to the local cache and can still be shown without violating it. But besides that, nobody argued that the download itself was the license violation.
If Roblox only downloaded and then deleted it without using it in any way, they'd not have violated the license. Was that the point you were making? If so okay, that's true but from my perspective a pretty stupid view. Surely you're aware that they didn't?
You can't enforce a license on a 3d model you in turn stole from a game.
Acteur a has a no permissive copyright
Acteur b has a non-commercial copyright on a model that infringes on a's non permissive copyright
Acteur c now can freely use it commercially, because b's copyright notice is invalid as it was never in a position to grant a permissive license
The stuff you learn on HN is truly breathtaking.
Thanks for clearing that up, that opens up a lot of avenues for future developments
Downloading content on the web is what the web is for. Using the data for training is something lawers need to figure out.
open3dlab should spend the time and energy, as unfortunate it is, to sue them to get this resolved.
Ablog post about this is basically 0 information. The stories about soooo many bots now crawling the internet and creating a lot more traffic is going through news and hn for month.
Fear that something will happen is not the same thing as evidence it has happened.
Sure it can. If you're downloading it for commercial purposes (clearly the case) you're violating the license.
Legally speaking, it is extremely well established that downloading is not the type of copying that “copyright” concerns itself with. And the GPL and similar licenses are predicated on copyright laws.
Once you make the content available in some other way, then copyright law might have something to say.
People in tech used to make fun of “you wouldn’t download a car”. It’s sad that so many have reversed their principles the moment a convenient villain shows up.
I guess we'll never know until you learn to read anything other than sheet music.
Yes, that's the whole point of the GPL. Use it however you want, but don't restrict the next person
Let me refer you to my earlier distinction between things that have happened and things you fear.
https://news.ycombinator.com/item?id=27710287
https://x.com/mitsuhiko/status/1410886329924194309
Which is different than using the data 1 to 1.
Or maybe the FSF is just waiting for everyone using AI code to become hooked and then subpoena every Antrophic/OAI/Codex customer and force the most massive source release in history (If Adobe/MS would file lawsuits vs the Craft apps and with their resources create legal precedent it could create chaos, maybe the only part stopping them right now from filing lawsuits is them realizing it could backfire since they're heavy AI users themselves).
I know there was some cases in the past where people swapped licences and changed variablenames,etc but the essential code clearly remained.
Im quite aware of software patents, i never had to use some software patent scanner in our compliance CI/CD.
So it might be a real issue no one can or does enforce?
So far it seems more cases that have been decided in lower instances or has been settled or gone in the direction of the party with most money for lawyers, still even in those cases there seems to be a slight tilt towards rightsholders.
I'm not saying anything categorically, but if some cases go all the way and towards rightsholders, it could become a real shitshow in the software industry since we've adopted AI so heavily and the non-significatng portion of public GPL licenced code could bite people in the ass.
I don't know what's more wrong: that a dumb model started downloading "Horse cock dildo" 3D models (to which end? to stuff that virtual 3D "horse cock dildo" in its own virtual LLM ass?) ...
Or that there exist "horse cock dildo" 3D models.
Seriously in which world are we living?
And I should be thinking about the people who designed that horse cock dildo and care about them? And those viewing those/using those? 3D printing those maybe? And I should care about the retards who can't even prevent their crawler from downloading 145 GB full of horse cock 3D dildo models and the like?
Nah. Fuck that, I care about my family and you're all on your own.
Crypto, big data, AI. It's all just another middle man hoping to scrape some joy out of everyone's lives to they can put a price tag on it and sell it to rubes and the government(and rubes in the government).