Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.
Obviously it's not just students, but the fact it [numerically] could be is rather amusing and makes me surprised that it's only 1 billion active users, since GPT has a lock on name recognition amongst low information users.
I'm naive, but is this possible? The power required per user to run those GPUs seems like enough to run an air conditioner. For a billion people everyday or so seems like enough to overload power plants.
Moreover, that translates to "it's actually carrying a huge nut* that puts extremely intense pressure on the company to figure out how to make as much money as possible as soon as possible."
(*nut is a slang word from loan sharking that has been adopted by (personal et al) finance people. It means "how much do you owe each month?" in the sense of, if you want to do a startup, advisors could ask, "what's your nut, and how much do you have left to self-invest?" Because monthly expense can be combined to a lump sum, it can also mean the size of the overall loan where the monthly interest is called the vig, "as long youze got da nut, you owe me da vig;" from vigorish, which would also require an etymology, but I'm assuming it's the word vigor combined with licorice meaning bitter tasting medicine, and nut because squirrels busy themselves carrying nuts.)
----
and if we can... and remember flame-prone people, if you reject the "can" premise, then the rest of the argument goes away, and you don't need to dispute it, you just say "you can't nuff said"; people here frequently seem challenged by propositions.
so, if we can...loosely describe the attitude you show here toward high market cap companies to be compatible with "left" or "socialist" or "populist" views shared by many others here, then I'll point out that at the same time wanting higher market prices paid for bounties because 'sploits are so expensive, is actually advocating for the same dread capitalist market based solution that leads to trillion dollar companies that never even had a trillion to begin with.
It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.
I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.
I speculate that the AI didn't find this and that human effort and intuition for where to look were needed to find this vulnerability.
Like half of the website was dysfunctiona and translations incredibly bad to the point of being nonsensical. That is if you were able to read them at all, because many just went off screen. Like, that's what your evil competitor does to your website after hijacking the domain, not you yourself, ffs
but hey you do you
Ethics and legal requirements shouldn’t be conflated.
There are times when ethics are a higher standard than what the law requires, and in that case the ethics are no less important.
If that means taking chunks of it because he can't be a responsible steward, so be it. It would behoove him to get on board before that is necessary.
But, hey if you want to defend billionaire narcissists that are destroying our planet and trying to take computing freedoms then I guess: you do you.
> server-side vulnerabilities are worth very little, because they quickly get patched.
Most people don't want to be felons.
I'm not that kind of hacker, but I guarantee I could be, complete with an abliterated model on my local rig, in a few minutes. Claude would happily set it all up for me, too.
In reality, I suppose I'm about to keep my rig busy staying ahead of the hackers.
What? Why would anyone work at a company paying them that much less than they pay the contractors?
Also, they were not OpenAI.