Hacker News

A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.

Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.

Wild to think a company supposedly worth a $trillion+ is doing shit like this.

I took over user accounts in Microsoft Copilot (there are caveats but still), and they asked me to provide additional information of the exploit (they wanted a video) and before I sent it they fixed the vulnerability, didn't pay me a cent. Fair? Idk.

It's a complicated issue in current LLM world where every day is a zero day, but fuck me sideways, company that claims to be worth trillion of dollars paying 5k for such an exploit is insulting at best.

It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.

I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.

That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI

I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.

This is a pet peeve of tptacek:

> server-side vulnerabilities are worth very little, because they quickly get patched.

Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.

They have just announced free API credits for Pro plan users up to $500 per month. Irony.

The buyer of your second vulnerability all depends on how you’re treated for your first vulnerability

OpenAI acknowledging and fixing the bug is worth millions

Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.

On the Work environment selector, "in the cloud" says "available on any device and can access your computer". Which seems pretty clear to me. (not that the labeling makes the security issue any better)

Claude Code terminal has "remote control" option activated via /rc command. -- somewhat similar in that it still runs the session on the PC/Mac but allows the Claude authenticated user to access the session via internet / app

I am guessing this ChatGPT functionality is a similar Codex feature?

But this session is disconnected when the conversation is /exit ed

I write mine, and will continue to do so, by hand. I would never consider letting an LLM touch my writing.

Posting frequency is another matter…

For my personal blog [0], I am still writing without LLM assistance. The goal is to test how well I understand the topic I am writing about, as well as to improve my own writing.

[0] https://trung.to

I actually still write my own blog [1] :sweat_smile:

Pure html by hand, using vim. No frameworks, no nothing, single stylesheet. I think there are a few others around here that still do this.

[1] https://armincat.com/

This one is particularly bad, like they probably made $7500 (not much tbh) for p1, atleast spend a few hours to write the blog post.

For who?

They're writing for bots, not humans. This is a marketing piece. They're trying to get themselves to come up as the answer when people ask chatbots questions.

You're not the target audience of writing on the Internet anymore.

It's AI written so of course it's hard to follow.

It's surprising that using JSONP in this way is even allowed. At one point google explicitly made sure to prevent this flavor of attack

https://stackoverflow.com/questions/2669690/why-does-google-...

hnslop (using salahadawi, using Pangram) puts this at 100% AI written, so that's probably why.

Report: https://www.salahadawi.com/hacker-news-ai-detector/50314699

hnslop: https://hnslop.nilsherzig.com/

I wonder if the new economics of finding bugs means that they pay the amount they think the tokens cost to find it.

I think you know that the mentality of a company like this is “security is a risk but not a reward and whoever captures the reward kills everyone else”

Did you mean exponentially? Logarithmic increase doesn't sound too bad.

it's not like microservices fare better, when you introduce them, you've traded a hard problem for a hard problem and distributed computing...

I like LOEC: Lines of Effective Code.

Much easier to reason and make decisions if the bar is "yeah it exists, but is it effective relative to its intended purpose?" This weeds out buggy code as well as under performant code. If it's not effective (broken, too slow, etc), it either needs a refactor or thrown on the scrap pile.

Reducing attack surface is a lesson for everyone. Newcomers are impressed by massive piles of code.

Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.

> Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it?

What's the joke? They're literally saying, every day, that this is true to a civilization endangering extent. They're making demands based on this, and politicians are taking up those demands.

And now they're paying bullshit $5K bug bounties for account-stealing exploits on their own platform. They should have paid more just the make the bug seem more grandiose; I don't know who let them get away with this - this is what happens when CEOs run their own PR I guess. It's basically an public announcement that they're total fakes.

My theory is vulns will never pay out big especially now, no matter how serious. Imagine they paid out $50k+ — it’d spawn an industry doing nothing but.

My latest project emails a magic link.

I'm trying not to have any important data to even lose, when I eventually get hacked.

We can all turn up our noses, like the other commenters in this thread, but every one of them is exposed. Negligence is a matter of degrees.

> please don’t login as me

Please don't drain my $6.5 billion in Dogecoin.

Been sayin this for years. Everybody in the world world: just BE COOL. Solves like every internet problem at once.

But couldn't they just turn around and sell this hackers for much more money?

I don't want to defend them, but the alternative is that they do nothing and you don't know about the vulnerability until a bad actor exploits it (something easy and cheap nowadays).

I'm confused, would you welcome that more?

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."

[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...

I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet

Also many emails from tech companies today:

- "sign in via one-time code."

- "Click here to see our latest update".

Thanks! Here, click on this link to get paid

The post seems to be talking about a html injection via a postMessage call where the receiver didn’t check who sent the message, which is a well known vulnerability entry point. Did I miss where OAuth had anything to do with this??

Production scale is not production grade I guess...