Yet another Hacker News

Roblox downloaded 145GB models from us (including adult content) without asking

143 points choult 1 hour ago 106 comments

hypfer 1 hour ago | parent

Only tangentially related, but I've recently realized that unless you're some sort of business with a valid requirement of that, you can just block incoming traffic from all of AWS, DigitalOcean, Azure, etc.

I think the spark came from some other HN comment I saw? So thank you for that, whoever wrote that.

That alone is not a sufficient strategy of course, but you can get rid of a lot of bots by just refusing to talk to where they tend to live.

Of course, if everyone were to do that, they'd eventually pivot to residential proxies. But I don't see that happening.

tommica 1 hour ago | parent

true! but how does one find all those ips?

hypfer 1 hour ago | parent

Just ask RIPE

Xylakant 1 hour ago | parent

That’s pretty easy - all major providers have public lists of IP ranges, usually as json files.

gunalx 1 hour ago | parent

Allmost all the bottraffic I see is from random residential proxies though.

timpera 1 hour ago | parent

Same, I just checked and this week the vast majority of the bot traffic I get is random residential IPs that all pretend to be the exact same Chrome 155 on Linux.

sgerenser 55 minutes ago | parent

Probably all people that fell for the “superbox” TV streamer scam.

Raed667 31 minutes ago | parent

do you have a good link to learn about this ?

doubled112 20 minutes ago | parent

https://www.eff.org/deeplinks/2025/06/fbi-warning-iot-device...

That’s probably a decent starting point, but a little older. I am not sure if the situation has changed any in 2026.

cube00 1 hour ago | parent

I initially thought this was a good idea too until another comment pointed out you'll lose most business or personal customers in offices because they connect through VPN gateways running on those cloud services (especially Azure)

hypfer 1 hour ago | parent

True but the question is if that matters.

I would argue that more often than not it might not. Really depends on the specifics though.

A lot of stuff on the web actually isn't really relevant for all audiences everywhere I'd say. It just happened to be accessible by all, because academics back in the day dreamt of a better open world that didn't really manifest :(

semiquaver 51 minutes ago | parent

This is a website about starting businesses.

Let me tell you, at the business I work at, some of our customers work at a company that uses a commercial VDI service for all workstations couldn’t access our service because the VDI egress was in GCP and we had an AWS WAF rule banning datacenter IPs.

Obviously, we removed the rule because it was doing nothing useful but plenty of harm. Real bots come from residential IPs.

hypfer 50 minutes ago | parent

Hm I mean HN _also_ is that? But not exclusively.

And even if we run with that assumption, one might still be fine. It's a trade-off, but, depending on the target audience, a few lost sales might be worth savings in other aspects.

anonreplier 39 minutes ago | parent

Can use cloudflare turnstile or similar instead

bigfishrunning 36 minutes ago | parent

> This is a website about starting businesses.

It's really not, unless the only qualifier for that is "hosted by a VC incubator". Most of the people here are here to argue about AI or Crypto or whatever, or read announcements from Nvidia and Google. I would bet less then 1% are starting businesses.

wtch98 35 minutes ago | parent

If you control the connecting device why not use MTLS?

gverrilla 31 minutes ago | parent

> day dreamt of a better open world that didn't really manifest :(

it is open and better indeed. open and better for capital - the true, living, flesh-eating god.

wtch98 36 minutes ago | parent

All my business traffic comes from either our own AS, or from ZScaler's AS

Do many companies really use azure etc rather than dedicated services like zscaler?

jeremyjh 1 hour ago | parent

There have been a number of articles on the frontpage of HN about the residential proxy traffic. It is happening. This was one of the most popular:

https://news.ycombinator.com/item?id=49491791

hypfer 1 hour ago | parent

I know, but it's an extra step, more expensive, and less legally solid.

None of these measures alone are a full solution, but if you stack a bunch of cheese slices, eventually, no holes line up anymore.

stopsayingsorry 1 hour ago | parent

>But I don't see that happening.

Then you are not looking. Already have to switch to resi proxies from time to time when encountering yet another smartass who decided to play security theater and block datacenter ips on his shitpile he calls website, because "OUR USERS MUST BE GOOD BOYS WHO LOVE TO LIVE UNDER SURVILANCE AND ALLOW ISP TO TRACK THEM 24/7" (and before you say something like "others can track you too!", your ISP has the ability to knock on your door, they should be given as little information as possible, let them do metadata analysis on per-person basis if they really want it, but no 1-click mass surveillance shit).

If you are valuable, you will be be scraped. Turning user hostile in a hopeless endeavor to "protect yourself" is not the solution.

hypfer 56 minutes ago | parent

I can see that you're having strong emotions about this, but that rant is just hard to read and serves primarily as venting and not really to convince anyone of anything.

Unless one zooms out and thinks "okay, these guys seem to react negatively if we do exactly that. We should do more of it", which is probably not what you want.

stopsayingsorry 46 minutes ago | parent

Nobody cares what you do, you are not smart enough. If you even entertain the idea of "let's just block datacenter ips!", all you accomplish by doing that is showcasing your incompetence and lose all respect from legitimate users who are good at tech. The scraper will just turn the resi proxy and will continue as is.

But maybe selecting for tech illiterate cattle as your userbase is what you want, then I guess more power to you. Don't be surprised by the scorn though.

hypfer 43 minutes ago | parent

I mean I am very willing to just try and see what happens?

Maybe I'm an idiot and it is a bad idea. But also maybe not?

Isn't it good if I "showcase my incompetence and lose all respect"? Wouldn't that be beneficial to people that disagree with these ideas?

stopsayingsorry 28 minutes ago | parent

Smart humans build mental models to predict the world or look what worked for others, but if you want to set yourself on fire to understand that it's a bad idea, you're free to do so, the smell is annoying though.

So go make the internet a little bit shittier just to discover once again the "data center is gone, yet total bot traffic is the same" wisdom. You already encouraged others to do the same, so the damage is already close to maximum your insignificant existence can accomplish.

hypfer 26 minutes ago | parent

I have to ask: is this an LLM? :D

Why would you just try the insulting harder? Why not pivot to literally any other strategy lmao

I mean I guess this would work on a lot of people here, but three times in a row? Come on man. Skill issue

splatter9859 5 minutes ago | parent

You seem to have some strong feels about this subject a bit disproportional to what the comment entails. I fail to see how someone sharing their opinion on HN equates to them having an "insignificant existence".

I get the frustration, but perhaps changing the target somewhat might be in order here, no?

sampullman 56 minutes ago | parent

It's hostile to you personally, but I wouldn't call it "user hostile".

Blocking "scrapping [sic]" is also not security theater, you misunderstand the intent of GP.

stopsayingsorry 42 minutes ago | parent

Anyone who thinks blocking datacenter ips helps with blocking scraping is a clown.

anonreplier 38 minutes ago | parent

exactly, there are lots of other more effective ways to block the likes of you

stopsayingsorry 22 minutes ago | parent

Let's hope you enjoy killing your real userbase with collateral damage, because that's the only thing you are going to accomplish.

sampullman 14 minutes ago | parent

It does, measurably. A massively popular site is going to get hammered with more advanced types of scraping, but they're going to have a team that can more easily mitigate it.

A site that doesn't care about corporate users basically loses nothing.

wtch98 31 minutes ago | parent

I trust my ISP far more than I trust bigtech. The downside of connecting from my ISP is that the site I connect to can fingerprint me trivially from the IP range

bruce343434 17 minutes ago | parent

Won't this harm SEO? What about agentic software suites where authorized users should be able to drop an app passkey into grokbot or such?

GL26 1 hour ago | parent

maybe stupid question but how is it possible to not be protected against supercrawlers like this, when you own large amounts of data, specially if all requests are coming from the same server ? Aren't cyberprotection services like CloudFlare work against this kind of "attacks" ?

Steve16384 1 hour ago | parent

Yeah, I can imagine it being a problem if it was from different IP addresses, but surely putting a limit on requests from a single IP would be a straightforward fix? Although maybe until it happens, you don't think about it.

caaqil 1 hour ago | parent

Who actually cares? Isn't the whole premise of the AI revolution just gorging ourselves with other people's data so we can have AGI? I was under the impression that we have accepted this sacrifice with OAI and friends leading the way.

tempfile 1 hour ago | parent

"we" in this sentence is really a handful of encloistered silicon valley weirdos. Most people do not like it and have no real say in the matter.

Steve16384 1 hour ago | parent

Who's "we"?

bulbar 50 minutes ago | parent

People really still buy into that framing? I think it's pretty clear that it's generally just about money as it has always been.

MSFT_Edging 15 minutes ago | parent

Tech is full of rubes that eat up the lies.

Crypto, big data, AI. It's all just another middle man hoping to scrape some joy out of everyone's lives to they can put a price tag on it and sell it to rubes and the government(and rubes in the government).

Artoooooor 15 minutes ago | parent

If the authors of the data are paid...ok. and not just the biggest players - every single one. But they are not.

KolmogorovComp 1 hour ago | parent

I'm sympatic to open3dlab but I think the focus on adult-content is just trying to spark outcry for cheap.

It has been shown times and times against that removing adult content from the training source (at least for diffusion models), results in generally lower-quality output, even outside of adult-content, particularly in terms of representing human bodies.

darthoctopus 52 minutes ago | parent

would the implied intent (from the inclusion of adult content) of training models on open3dlab content, without asking them, render Roblox's actions _less_ antisocial???

Betelbuddy 46 minutes ago | parent

The current AI Ethos is morality is just another obstacle on the way to their IPO. ...Lets just hope after they get rich, they stay away, and dont bother us with books, videos and conference speeches on entrepreneurship mentoring...

criddell 4 minutes ago | parent

[delayed]

swiftcoder 1 hour ago | parent

I wonder at what point the Roblox kids all reach 18 years old, and Roblox can pivot them all to a separate adult version thereof...

phoghed 4 minutes ago | parent

Never, it gets new players constantly. This is like saying I wonder when YouTube is going to turn into Pornhub

peridotintellig 1 hour ago | parent

I'm not even impressed..

bijowo1676 1 hour ago | parent

if you put stuff available to download, dont be surprised that someone will download it

What is the actual news here, can anyone explain ????

freecodeio 54 minutes ago | parent

honestly for me is the hypocrisy

we've spent the entire 2010s with lots of talk whether creating a scraper for google or linkedin and packaging that data to sell is illegal just for the entire thing to turn around where large companies are basically burning small servers down with requests to do the exact same thing

well_ackshually 41 minutes ago | parent

Man if only there was such a thing as good manners, good behaviour, accepted practices from a community to not massively hammer servers. If only these websites had been up for a decade with very few problems, before a notoriously manipulative, lying, deceiving, abusive company that makes money off of child abusers came in and just went hurr durr free data in the WORST possible way instead of just politely asking for a dump.

numpad0 36 minutes ago | parent

"Leopard ate MY face" ?

offbeatport 32 minutes ago | parent

They didn't do it in the intended manner.

> The crawler did not respect our robots.txt, (which it did retrieve), ignored our Terms of Service, (which forbid scraping), and defied the creators' licenses: 423 of the 712 projects are licensed for non-commercial use only.

tarsierscripter 27 minutes ago | parent

The news is that people download it so much that they saturate your server’s connection and/or peg its CPU or disk (whichever is the weakest link in the chain). We used to call this a Denial of Service attack but now it’s apparently just a cost of doing business, even for people who just want to run a non-commercial hobby site.

233mhz 16 minutes ago | parent

https://therecord.media/linkedin-wins-court-order-blocking-m...

Which is it then? Megacorps can enforce their TOS through the law but small companies cannot?

j-pb 1 hour ago | parent

3$ in outbound traffic on a public service, how is this news?

dofm 58 minutes ago | parent

I mean, it's not the size of the download, it's the unauthorised scraping of community assets strictly against terms and ignoring robots.txt by an American corporation. Resource of a kind that used to get kids threatened with spending most of their life in prison.

But I agree that this kind of theft by US corporations is no longer news.

(Yes, it's theft: they were aware they may not do it and according to the article attempted to get around further restrictions. I mean it's literally even theft of the $3 you mention — you don't have to be in possession the $3 to illegally deprive its owner of it under common theft statutes)

whizzter 31 minutes ago | parent

Aaron Swartz pulled down by the legal system for trying to get things accessible for people instead of being blocked by profit requirements.

Companies copying things to make profit for themselves not being held accountable.

Progress is one thing, injustice is another.

semiquaver 55 minutes ago | parent

So what? You made your content available and someone downloaded it. Why is this even notable?

jalict 51 minutes ago | parent

Would you also say that general licensing is irrelevant for everyone?

semiquaver 48 minutes ago | parent

Of course not. But there’s no indication whatsoever that any license has been violated. Downloading a file from a free access server cannot violate license terms.

Fear that something will happen is not the same thing as evidence it has happened.

philipwhiuk 39 minutes ago | parent

> Downloading a file from a free access server cannot violate license terms.

Sure it can. If you're downloading it for commercial purposes (clearly the case) you're violating the license.

well_ackshually 39 minutes ago | parent

If only you could read the article and see that the vast majority of the assets are licensed under a non-commercial clause.

I guess we'll never know until you learn to read anything other than sheet music.

hakube 23 minutes ago | parent

Can't believe we have corporate kiss ass in here

not-kinsale-joe 44 minutes ago | parent

Can I scrape all GPL source code from github. Then use the code commercially and then say so what, they made their source code available to download?

origini 39 minutes ago | parent

Right now, its legal to use this data to train a model.

Which is different than using the data 1 to 1.

whizzter 25 minutes ago | parent

I think technically such a model should abide by the licence of the inputs, hence all models would probably be GPL if the FSF had resources to fight it and the legal profession had an inkling of the processes involved.

Or maybe the FSF is just waiting for everyone using AI code to become hooked and then subpoena every Antrophic/OAI/Codex customer and force the most massive source release in history (If Adobe/MS would file lawsuits vs the Craft apps and with their resources create legal precedent it could create chaos, maybe the only part stopping them right now from filing lawsuits is them realizing it could backfire since they're heavy AI users themselves).

origini 19 minutes ago | parent

But as far as i know GPL does not prevent you from using it for training?

wtch98 26 minutes ago | parent

> Can I scrape all GPL source code from github. Then use the code commercially and then say so what, they made their source code available to download?

Yes, that's the whole point of the GPL. Use it however you want, but don't restrict the next person

Artoooooor 17 minutes ago | parent

Oh, it would be so nice to force the Great Thieves like "open"AI to release their weights on GPL license...

bsenftner 54 minutes ago | parent

If that data is at all important, why is is downloadable?

jalict 53 minutes ago | parent

This is quite simple put in the article.

bsenftner 46 minutes ago | parent

A robots.txt file is not anything, not enforceable, it's politeness. Of course it was ignored.

fg137 42 minutes ago | parent

That fight was already lost back in 2024.

ForHackernews 19 minutes ago | parent

Sue them. They'd sue you for ignoring their ToS.

whizzter 37 minutes ago | parent

It's a community site, first model I looked at (Tanya by Shrimport) is under CC-BY-ND-NC licence (Creative Commons, By attribution, No-derivatives, Non-commercial).

AI training by definition is derivative, and Roblox not using it for commercial purposes if used in production is practically nil.

This is a huge part of why AI upsets people, we can't have nice things such as communities where people are sharing 3d models without it being feeding ground for commercial companies that has little intention to ever honor any licences or compensate authors.

bunderbunder 26 minutes ago | parent

If courts say that training models is fair use then copyright and license terms are moot.

phoghed 4 minutes ago | parent

It’s not fully played out in the courts yet, but so far doesn’t look like it’s going to be enforced how you want it to be.

speedgoose 48 minutes ago | parent

145GB isn’t much. It fits in RAM in some computers.

superultra 19 minutes ago | parent

145gb of ram? Check out Mr. Moneybags over here!

echoangle 46 minutes ago | parent

Couldn't the adult file download just as well be used to train a model that rejects adult uploads to roblox? I don't see the outrage.

littlecranky67 45 minutes ago | parent

I know it is an unpopular opinion, but if you do not want your content to be scraped, you have to put it behind payment walls and copyright it. In Germany we have decisions from the highest courts that deemed websracping perfectly legal (it was in the context of a competitor scraping airline ticket fares).

ffsm8 36 minutes ago | parent

They ignored the licenses, so kinda moot point you're making.

littlecranky67 23 minutes ago | parent

And how were those license conditions violated by downloading? Their are permissive in the first place, and violating without passing on to a third party is almost impossible.

ffsm8 13 minutes ago | parent

Were they used in a commercial context when a commercial entity downloaded it?

If yes, they were in violation of the license. Fyi, that's explicitly stated in the article we're commenting on.

littlecranky67 11 minutes ago | parent

Supposedly they are, that is enforceable how? Download is not anything. Training AI on them is not anything. Using the trained model is not a violation of the terms just because you think it should be.

ffsm8 7 minutes ago | parent

i see. as long as i can download Software that is made available for free for students its completely legal to do so and use them commercially as a non-student, after all its freely downloadable.

good thing you explained how copyright works legally, almost spend my money unnecessarily.

echoangle 6 minutes ago | parent

If it’s fair use, the license doesn’t matter.

philipwhiuk 40 minutes ago | parent

I assume they need the adult content in order to detect adult content generated by their users.

origini 38 minutes ago | parent

I'm just to ignorant to this in context of how the reality just works.

Downloading content on the web is what the web is for. Using the data for training is something lawers need to figure out.

open3dlab should spend the time and energy, as unfortunate it is, to sue them to get this resolved.

Ablog post about this is basically 0 information. The stories about soooo many bots now crawling the internet and creating a lot more traffic is going through news and hn for month.

phn 35 minutes ago | parent

How can you start an outcry like this, but host stuff like this, tagged with a permissive license:

https://open3dlab.com/project/e2a0830d-f166-4b1b-aabf-8ca735...

Just an example, there's plenty more on the frontpage.

I have nothing against these guys, but I just can't understand the moral high ground of the complaint.

Nekorosu 33 minutes ago | parent

Oddly, this makes their argument even stronger. Why would Roblox download this?

pizzafeelsright 21 minutes ago | parent

The game at the moment is capture as much content as possible.

venussnatch 33 minutes ago | parent

DMCA safe harbor? They're not responsible for user uploads until they are made aware of violations.

phn 28 minutes ago | parent

Scroll through the site, there are A LOT of assets from games, packaged by users. It's a nice subtrefuge, in practice it is a place to get ripped assets and the platform washes it's hands.

Again, I don't have any particularly strong issue with this, just with the pearl clutching regarding roblox downloading the data.

gmerc 20 minutes ago | parent

Then Roblox trains on it and voila…

pastage 32 minutes ago | parent

Considering you link something that has a non comnercial license CC-by-NC, there might be others with permissive licenses. There might be things in their TOS of the site,

phn 29 minutes ago | parent

There's more with different licenses. If you scroll through the pages, there are a lot of assets ripped from games, with a variety of licenses CC-by-NC, or just "beerware":

https://open3dlab.com/project/0a4538ba-00df-4f6d-b3e3-14d978...

deadbabe 19 minutes ago | parent

Moral high grounds don't mean much these days. They are weaponized as a way to get an advantage in an argument.

amiga386 11 minutes ago | parent

If you read the article, you'd find they admit to that, their position is nuanced, and this is not a "gotcha".

> We'll be honest about where we stand. We don't like copyright as it exists. We'd like to see it radically reformed, and we wouldn't mourn it if it were abolished. Our community lives in its grey areas every day: many of the models on our sites are fan ports of characters from commercial games, made out of love and shared for free. When a studio sends us a takedown notice, we comply.

> While we as small artists and fan communities get copyright used against us, the world's largest companies are committing copyright infringement at a scale unseen in human history. This has been the case since the invention of the internet of course; digital media make duplication, remixing and resharing trivial, but copyright law never caught up. Filesharing stabbed copyright in the gut. AI is just twisting the knife, and completes the creation an unequal system where copyright infringement is only a crime if you're a low net worth individual.

Sopel 4 minutes ago | parent

well it kinda worked? over on reddit r/gaming thinks the data has been stolen

more radicalization towards AI

andreygrehov 7 minutes ago | parent

The internet must understand one simple rule. What’s downloadable will always be downloaded. There are plenty of people who don’t give a flying fk about your LICENSE.md, robots.txt, ToS and whatnot. It’s like leaving your bicycle unlocked in public. Even if there is a giant cardboard next to it saying: “please, don’t steal” - nobody cares.