I am guessing this ChatGPT functionality is a similar Codex feature?
But this session is disconnected when the conversation is /exit ed
https://stackoverflow.com/questions/2669690/why-does-google-...
You're not the target audience of writing on the Internet anymore.
[0] https://trung.to
Pure html by hand, using vim. No frameworks, no nothing, single stylesheet. I think there are a few others around here that still do this.
I really hope they get hacked and crash down burning in flames like the Hindenburg
This bug could not be found by just asking an AI "find bugs in ChatGPT", that's why it was reported through a bug bounty programs and that's why it should be worth more than $5k
but then again since you're not naive, you already know these AI companies like openai already act evil and like bad entities.
I conclude therefore, per your words "you are the last one anyone should consult with, basically about anything"
Sounds exponential
Much easier to reason and make decisions if the bar is "yeah it exists, but is it effective relative to its intended purpose?" This weeds out buggy code as well as under performant code. If it's not effective (broken, too slow, etc), it either needs a refactor or thrown on the scrap pile.
Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.
A single line in C++, Rust or Haskell can have a really subtle logic error. A single line in assembly can't, but it has that same likelihood of having a register allocation error instead, and when you add up all the many lines of assembly you probably still wrote the same number of logic errors as the C++ version.
What's the joke? They're literally saying, every day, that this is true to a civilization endangering extent. They're making demands based on this, and politicians are taking up those demands.
And now they're paying bullshit $5K bug bounties for account-stealing exploits on their own platform. They should have paid more just the make the bug seem more grandiose; I don't know who let them get away with this - this is what happens when CEOs run their own PR I guess. It's basically an public announcement that they're total fakes.
I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.
5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.
Meanwhile the actual user of the account probably has to sign in using a yubikey because they get "CyBeRsEcRuItY aLeRtS" when they try to update node in their project to fix a crash and have to switch to daybreak blue to continue (or attempt to trick the normal models into doing it and risk getting autobanned)
I'm trying not to have any important data to even lose, when I eventually get hacked.
We can all turn up our noses, like the other commenters in this thread, but every one of them is exposed. Negligence is a matter of degrees.
Please don't drain my $6.5 billion in Dogecoin.
dont click links people
that'll be $500k for the security training pls
We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
This has been a thing since forever lol
If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...
- "sign in via one-time code."
- "Click here to see our latest update".
hilarious that their headline message, on every web page, is `Backed by YC`.
also, the product is way behind their competitors anyway.
really cool exploit they found here, but that doesn't make them a company worth doing business with.
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.
Moreover, that translates to "it's actually carrying a huge nut* that puts extremely intense pressure on the company to figure out how to make as much money as possible as soon as possible."
(*nut is a slang word from loan sharking that has been adopted by (personal et al) finance people. It means "how much do you owe each month?" in the sense of, if you want to do a startup, advisors could ask, "what's your nut, and how much do you have left to self-invest?" Because monthly expense can be combined to a lump sum, it can also mean the size of the overall loan where the monthly interest is called the vig, "as long youze got da nut, you owe me da vig;" from vigorish, which would also require an etymology, but I'm assuming it's the word vigor combined with licorice meaning bitter tasting medicine, and nut because squirrels busy themselves carrying nuts.)
----
and if we can... and remember flame-prone people, if you reject the "can" premise, then the rest of the argument goes away, and you don't need to dispute it, you just say "you can't nuff said"; people here frequently seem challenged by propositions.
so, if we can...loosely describe the attitude you show here toward high market cap companies to be compatible with "left" or "socialist" or "populist" views shared by many others here, then I'll point out that at the same time wanting higher market prices paid for bounties because 'sploits are so expensive, is actually advocating for the same dread capitalist market based solution that leads to trillion dollar companies that never even had a trillion to begin with.
It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.
I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.
I speculate that the AI didn't find this and that human effort and intuition for where to look were needed to find this vulnerability.
Like half of the website was dysfunctiona and translations incredibly bad to the point of being nonsensical. That is if you were able to read them at all, because many just went off screen. Like, that's what your evil competitor does to your website after hijacking the domain, not you yourself, ffs
What? Why would anyone work at a company paying them that much less than they pay the contractors?
but hey you do you
Ethics and legal requirements shouldn’t be conflated.
There are times when ethics are a higher standard than what the law requires, and in that case the ethics are no less important.
But, hey if you want to defend billionaire narcissists that are destroying our planet and trying to take computing freedoms then I guess: you do you.
> server-side vulnerabilities are worth very little, because they quickly get patched.
Most people don't want to be felons.
I'm not that kind of hacker, but I guarantee I could be, complete with an abliterated model on my local rig, in a few minutes. Claude would happily set it all up for me, too.
In reality, I suppose I'm about to keep my rig busy staying ahead of the hackers.
Also, they were not OpenAI.