News for hackers. Stuff that matters.

A comment on Why aren't AI companies being charged for hacking?. Parent comment

Re:Why aren't AI companies being charged for hacking? by drdexebtjl on Monday October 12, 2026 @12:31PM (#50058841)
A local mirror of the latest N versions of every package and docs of any package ecosystem they want is perfectly viable.

No, not anyone who uses a shared hosting environment, but certainly anyone who runs unaligned models they know have cyber weapon capabilities. They should be considered an untrusted 3rd party.

[ Parent | on HN ]
Re:Why aren't AI companies being charged for hacking? by gruez on Monday October 12, 2026 @12:53PM (#50059188)
>A local mirror of the latest N versions of every package and docs of any package ecosystem they want is perfectly viable.

Something tells me that's harder than it sounds, given that even ci/cd environments don't bother maintaining package caches for npm/pypi, even though that would provide massive bandwidth savings.

[ Parent | on HN ]
Re:Why aren't AI companies being charged for hacking? by drdexebtjl on Monday October 12, 2026 @02:38PM (#50060832)
They do, though. AWS offers CodeArtifact, which is basically that as a service.
[ Parent | on HN ]
Re:Why aren't AI companies being charged for hacking? by gruez on Monday October 12, 2026 @03:02PM (#50061188)
That just proxies to the origin repository, creating the exact issue that artifactory has.
[ Parent | on HN ]
Re:Why aren't AI companies being charged for hacking? by drdexebtjl on Monday October 12, 2026 @03:06PM (#50061256)
Of course. I was just challenging your point that no one is building an npm/pypi cache.

edit: This [1] 2022 dataset of npm packages had 19 TB, containing every package and every version. Perfectly viable for OpenAI, even if we estimate npm grew significantly in 4 years. In practice you wouldn’t need to have every version for it to be functional.

1: https://www.jonbell.net/preprint/msr23-npm.pdf

[ Parent | on HN ]