It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.
Obviously it's not just students, but the fact it [numerically] could be is rather amusing and makes me surprised that it's only 1 billion active users, since GPT has a lock on name recognition amongst low information users.
I'm naive, but is this possible? The power required per user to run those GPUs seems like enough to run an air conditioner. For a billion people everyday or so seems like enough to overload power plants.
Moreover, that translates to "it's actually carrying a huge nut* that puts extremely intense pressure on the company to figure out how to make as much money as possible as soon as possible."
(*nut is a slang word from loan sharking that has been adopted by (personal et al) finance people. It means "how much do you owe each month?" in the sense of, if you want to do a startup, advisors could ask, "what's your nut, and how much do you have left to self-invest?" Because monthly expense can be combined to a lump sum, it can also mean the size of the overall loan where the monthly interest is called the vig, "as long youze got da nut, you owe me da vig;" from vigorish, which would also require an etymology, but I'm assuming it's the word vigor combined with licorice meaning bitter tasting medicine, and nut because squirrels busy themselves carrying nuts.)
----
and if we can... and remember flame-prone people, if you reject the "can" premise, then the rest of the argument goes away, and you don't need to dispute it, you just say "you can't nuff said"; people here frequently seem challenged by propositions.
so, if we can...loosely describe the attitude you show here toward high market cap companies to be compatible with "left" or "socialist" or "populist" views shared by many others here, then I'll point out that at the same time wanting higher market prices paid for bounties because 'sploits are so expensive, is actually advocating for the same dread capitalist market based solution that leads to trillion dollar companies that never even had a trillion to begin with.
It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.
I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.
I speculate that the AI didn't find this and that human effort and intuition for where to look were needed to find this vulnerability.
Like half of the website was dysfunctiona and translations incredibly bad to the point of being nonsensical. That is if you were able to read them at all, because many just went off screen. Like, that's what your evil competitor does to your website after hijacking the domain, not you yourself, ffs
but hey you do you
Ethics and legal requirements shouldn’t be conflated.
There are times when ethics are a higher standard than what the law requires, and in that case the ethics are no less important.
If that means taking chunks of it because he can't be a responsible steward, so be it. It would behoove him to get on board before that is necessary.
But, hey if you want to defend billionaire narcissists that are destroying our planet and trying to take computing freedoms then I guess: you do you.
> server-side vulnerabilities are worth very little, because they quickly get patched.
Most people don't want to be felons.
I'm not that kind of hacker, but I guarantee I could be, complete with an abliterated model on my local rig, in a few minutes. Claude would happily set it all up for me, too.
In reality, I suppose I'm about to keep my rig busy staying ahead of the hackers.
What? Why would anyone work at a company paying them that much less than they pay the contractors?
Also, they were not OpenAI.
I am guessing this ChatGPT functionality is a similar Codex feature?
But this session is disconnected when the conversation is /exit ed
You're not the target audience of writing on the Internet anymore.
https://stackoverflow.com/questions/2669690/why-does-google-...
Report: https://www.salahadawi.com/hacker-news-ai-detector/50314699
hnslop: https://hnslop.nilsherzig.com/
[0] https://trung.to
Posting frequency is another matter…
Pure html by hand, using vim. No frameworks, no nothing, single stylesheet. I think there are a few others around here that still do this.
I really hope they get hacked and crash down burning in flames like the Hindenburg
This bug could not be found by just asking an AI "find bugs in ChatGPT", that's why it was reported through a bug bounty programs and that's why it should be worth more than $5k
but then again since you're not naive, you already know these AI companies like openai already act evil and like bad entities.
I conclude therefore, per your words "you are the last one anyone should consult with, basically about anything"
exponential: 2^x, 3^x, etc
Everything in the second group eventually grows faster than everything in the first group, no matter how small and big you make the fixed numbers, so they are two different classes.
Sounds exponential
99.9% of shops need a monolith with same monolith having entry points for background workers and crons.
Much easier to reason and make decisions if the bar is "yeah it exists, but is it effective relative to its intended purpose?" This weeds out buggy code as well as under performant code. If it's not effective (broken, too slow, etc), it either needs a refactor or thrown on the scrap pile.
Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.
A single line in C++, Rust or Haskell can have a really subtle logic error. A single line in assembly can't, but it has that same likelihood of having a register allocation error instead, and when you add up all the many lines of assembly you probably still wrote the same number of logic errors as the C++ version.
What's the joke? They're literally saying, every day, that this is true to a civilization endangering extent. They're making demands based on this, and politicians are taking up those demands.
And now they're paying bullshit $5K bug bounties for account-stealing exploits on their own platform. They should have paid more just the make the bug seem more grandiose; I don't know who let them get away with this - this is what happens when CEOs run their own PR I guess. It's basically an public announcement that they're total fakes.
I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.
I'm trying not to have any important data to even lose, when I eventually get hacked.
We can all turn up our noses, like the other commenters in this thread, but every one of them is exposed. Negligence is a matter of degrees.
This is the way. Respect user privacy and keep as little data as possible, and not only do you become a less attractive target, if you are targeted the outcome won’t be so bad.
Please don't drain my $6.5 billion in Dogecoin.
5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.
Meanwhile the actual user of the account probably has to sign in using a yubikey because they get "CyBeRsEcRuItY aLeRtS" when they try to update node in their project to fix a crash and have to switch to daybreak blue to continue (or attempt to trick the normal models into doing it and risk getting autobanned)
I'm confused, would you welcome that more?
dont click links people
that'll be $500k for the security training pls
We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
This has been a thing since forever lol
If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)
[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...
- "sign in via one-time code."
- "Click here to see our latest update".
250k refresher fee
hilarious that their headline message, on every web page, is `Backed by YC`.
also, the product is way behind their competitors anyway.
really cool exploit they found here, but that doesn't make them a company worth doing business with.