Spooky all year
kiwifarms.net
- Dołączono
- 5 Lis 2024
I asked Claudius, based on what you told me you put in, what they could realistically get from you.I don't know how asking it primitive questions is all that much to worry about. I literally just asked it how to decode ISO4909 and had it help me optimize my nginx config, which it was a little overzealous about.
Take his two examples. ISO 4909 is the standard for magnetic stripe track 3 data, so he just told Zhipu that this account belongs to someone working on payment cards — POS, ATM, or card processing infrastructure. That single query is already a targeting indicator. The nginx optimization is worse if he pasted any real config: server_name directives reveal his domains, upstream blocks reveal internal service architecture and hostnames, location blocks reveal API endpoints, and the overall shape of the file reveals his tech stack even if he sanitized the obvious secrets. Most people sanitize passwords and forget that the structure itself is intelligence.
Now add the metadata layer: IP address, account email if he registered, query timing patterns, language fingerprint, what time zone he operates in, what other queries he runs over six months. You end up with a person identified by sector and employer, working on specific infrastructure he's just described in detail, with predictable habits. That is a dossier good enough to phish him precisely or to sell to someone who will.
The legal piece is the part people genuinely underrate. Under the PRC's National Intelligence Law (2017), Article 7, Chinese organizations and citizens are legally obligated to support and cooperate with national intelligence work. The Data Security Law (2021) and the Cybersecurity Law layer on top of that. There is no warrant requirement comparable to Western frameworks, no judicial review, and no meaningful recourse. Zhipu AI is a PRC entity headquartered in Beijing, and everything that touches their infrastructure sits under that regime by default. It is not a question of whether they would cooperate with a request — they are required to.
Now add the metadata layer: IP address, account email if he registered, query timing patterns, language fingerprint, what time zone he operates in, what other queries he runs over six months. You end up with a person identified by sector and employer, working on specific infrastructure he's just described in detail, with predictable habits. That is a dossier good enough to phish him precisely or to sell to someone who will.
The legal piece is the part people genuinely underrate. Under the PRC's National Intelligence Law (2017), Article 7, Chinese organizations and citizens are legally obligated to support and cooperate with national intelligence work. The Data Security Law (2021) and the Cybersecurity Law layer on top of that. There is no warrant requirement comparable to Western frameworks, no judicial review, and no meaningful recourse. Zhipu AI is a PRC entity headquartered in Beijing, and everything that touches their infrastructure sits under that regime by default. It is not a question of whether they would cooperate with a request — they are required to.
Do with that what you will, bud. Personally, I'd stay far away from any chinky shit.