Posted by armcat 13 hours ago
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.
Moreover, that translates to "it's actually carrying a huge nut* that puts extremely intense pressure on the company to figure out how to make as much money as possible as soon as possible."
(*nut is a slang word from loan sharking that has been adopted by (personal et al) finance people. It means "how much do you owe each month?" in the sense of, if you want to do a startup, advisors could ask, "what's your nut, and how much do you have left to self-invest?" Because monthly expense can be combined to a lump sum, it can also mean the size of the overall loan where the monthly interest is called the vig, "as long youze got da nut, you owe me da vig;" from vigorish, which would also require an etymology, but I'm assuming it's the word vigor combined with licorice meaning bitter tasting medicine, and nut because squirrels busy themselves carrying nuts.)
----
and if we can... and remember flame-prone people, if you reject the "can" premise, then the rest of the argument goes away, and you don't need to dispute it, you just say "you can't nuff said"; people here frequently seem challenged by propositions.
so, if we can...loosely describe the attitude you show here toward high market cap companies to be compatible with "left" or "socialist" or "populist" views shared by many others here, then I'll point out that at the same time wanting higher market prices paid for bounties because 'sploits are so expensive, is actually advocating for the same dread capitalist market based solution that leads to trillion dollar companies that never even had a trillion to begin with.
I speculate that the AI didn't find this and that human effort and intuition for where to look were needed to find this vulnerability.
Like half of the website was dysfunctiona and translations incredibly bad to the point of being nonsensical. That is if you were able to read them at all, because many just went off screen. Like, that's what your evil competitor does to your website after hijacking the domain, not you yourself, ffs
but hey you do you
Ethics and legal requirements shouldn’t be conflated.
There are times when ethics are a higher standard than what the law requires, and in that case the ethics are no less important.
But, hey if you want to defend billionaire narcissists that are destroying our planet and trying to take computing freedoms then I guess: you do you.
What? Why would anyone work at a company paying them that much less than they pay the contractors?
> server-side vulnerabilities are worth very little, because they quickly get patched.
Most people don't want to be felons.
I'm not that kind of hacker, but I guarantee I could be, complete with an abliterated model on my local rig, in a few minutes. Claude would happily set it all up for me, too.
In reality, I suppose I'm about to keep my rig busy staying ahead of the hackers.
Also, they were not OpenAI.
I am guessing this ChatGPT functionality is a similar Codex feature?
But this session is disconnected when the conversation is /exit ed
You're not the target audience of writing on the Internet anymore.
[0] https://trung.to
Pure html by hand, using vim. No frameworks, no nothing, single stylesheet. I think there are a few others around here that still do this.
I really hope they get hacked and crash down burning in flames like the Hindenburg
This bug could not be found by just asking an AI "find bugs in ChatGPT", that's why it was reported through a bug bounty programs and that's why it should be worth more than $5k
but then again since you're not naive, you already know these AI companies like openai already act evil and like bad entities.
I conclude therefore, per your words "you are the last one anyone should consult with, basically about anything"
exponential: 2^x, 3^x, etc
Everything in the second group eventually grows faster than everything in the first group, no matter how small and big you make the fixed numbers, so they are two different classes.
Sounds exponential
99.9% of shops need a monolith with same monolith having entry points for background workers and crons.
Much easier to reason and make decisions if the bar is "yeah it exists, but is it effective relative to its intended purpose?" This weeds out buggy code as well as under performant code. If it's not effective (broken, too slow, etc), it either needs a refactor or thrown on the scrap pile.
Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.
A single line in C++, Rust or Haskell can have a really subtle logic error. A single line in assembly can't, but it has that same likelihood of having a register allocation error instead, and when you add up all the many lines of assembly you probably still wrote the same number of logic errors as the C++ version.
What's the joke? They're literally saying, every day, that this is true to a civilization endangering extent. They're making demands based on this, and politicians are taking up those demands.
And now they're paying bullshit $5K bug bounties for account-stealing exploits on their own platform. They should have paid more just the make the bug seem more grandiose; I don't know who let them get away with this - this is what happens when CEOs run their own PR I guess. It's basically an public announcement that they're total fakes.
I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.
I'm confused, would you welcome that more?
5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.