Please don't drain my $6.5 billion in Dogecoin.","title":null,"type":"comment","url":null},{"author":"chamomeal","children":[{"author":"15o9o","children":[],"created_at":"2026-10-31T14:08:07.000Z","created_at_i":1793455687,"id":50316354,"options":[],"parent_id":50315969,"points":null,"story_id":50314699,"text":"we all joke but spiritual communities have been saying this is the way for years. Like the law of one stuff.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T13:23:37.000Z","created_at_i":1793453017,"id":50315969,"options":[],"parent_id":50314705,"points":null,"story_id":50314699,"text":"Been sayin this for years. Everybody in the world world: just BE COOL. Solves like every internet problem at once.","title":null,"type":"comment","url":null},{"author":"qup","children":[{"author":"latexr","children":[],"created_at":"2026-10-31T14:05:05.000Z","created_at_i":1793455505,"id":50316325,"options":[],"parent_id":50316131,"points":null,"story_id":50314699,"text":"> I'm trying not to have any important data to even lose
This is the way. Respect user privacy and keep as little data as possible, and not only do you become a less attractive target, if you are targeted the outcome won\u2019t be so bad.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T13:42:53.000Z","created_at_i":1793454173,"id":50316131,"options":[],"parent_id":50314705,"points":null,"story_id":50314699,"text":"My latest project emails a magic link.
I'm trying not to have any important data to even lose, when I eventually get hacked.
We can all turn up our noses, like the other commenters in this thread, but every one of them is exposed. Negligence is a matter of degrees.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T10:31:43.000Z","created_at_i":1793442703,"id":50314705,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"we are getting to the point of \u201cwhy have passwords?\u201d Right? At some point soon we have to move to the honor system of just please don\u2019t login as me?","title":null,"type":"comment","url":null},{"author":"jareklupinski","children":[{"author":"bossyTeacher","children":[{"author":"jareklupinski","children":[{"author":"atrokhymchuk","children":[],"created_at":"2026-10-31T12:20:00.000Z","created_at_i":1793449200,"id":50315456,"options":[],"parent_id":50315307,"points":null,"story_id":50314699,"text":"hey, don't dump the market","title":null,"type":"comment","url":null},{"author":"pkthunder","children":[],"created_at":"2026-10-31T13:33:24.000Z","created_at_i":1793453604,"id":50316050,"options":[],"parent_id":50315307,"points":null,"story_id":50314699,"text":"Click this link to be told not to click links.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:02:11.000Z","created_at_i":1793448131,"id":50315307,"options":[],"parent_id":50315181,"points":null,"story_id":50314699,"text":"dont click links
250k refresher fee","title":null,"type":"comment","url":null},{"author":"kotaKat","children":[],"created_at":"2026-10-31T12:19:10.000Z","created_at_i":1793449150,"id":50315447,"options":[],"parent_id":50315181,"points":null,"story_id":50314699,"text":""Scan this QR code!"","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T11:49:22.000Z","created_at_i":1793447362,"id":50315181,"options":[],"parent_id":50315167,"points":null,"story_id":50314699,"text":"Also many emails from tech companies today:
- "sign in via one-time code."
- "Click here to see our latest update".","title":null,"type":"comment","url":null},{"author":"Razengan","children":[],"created_at":"2026-10-31T12:17:41.000Z","created_at_i":1793449061,"id":50315436,"options":[],"parent_id":50315167,"points":null,"story_id":50314699,"text":"Thanks! Here, click on this link to get paid","title":null,"type":"comment","url":null},{"author":"TobTobXX","children":[{"author":"Antipode","children":[],"created_at":"2026-10-31T13:16:41.000Z","created_at_i":1793452601,"id":50315927,"options":[],"parent_id":50315491,"points":null,"story_id":50314699,"text":"I've worked at a company that did link mangling on everything except simulated phishing emails. The effect was that people were trained to trust the mangled links.","title":null,"type":"comment","url":null},{"author":"extraextra","children":[],"created_at":"2026-10-31T14:34:17.000Z","created_at_i":1793457257,"id":50316572,"options":[],"parent_id":50315491,"points":null,"story_id":50314699,"text":"God I hate those","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:23:59.000Z","created_at_i":1793449439,"id":50315491,"options":[],"parent_id":50315167,"points":null,"story_id":50314699,"text":"... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."
[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...","title":null,"type":"comment","url":null},{"author":"kro","children":[{"author":"weird-eye-issue","children":[],"created_at":"2026-10-31T14:22:30.000Z","created_at_i":1793456550,"id":50316482,"options":[],"parent_id":50315559,"points":null,"story_id":50314699,"text":"> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
This has been a thing since forever lol","title":null,"type":"comment","url":null},{"author":"dpark","children":[{"author":"kro","children":[],"created_at":"2026-10-31T15:39:58.000Z","created_at_i":1793461198,"id":50317178,"options":[],"parent_id":50316591,"points":null,"story_id":50314699,"text":"Yes, if it requires the user session (xss related), like the article, there is no problem.
I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:37:07.000Z","created_at_i":1793457427,"id":50316591,"options":[],"parent_id":50315559,"points":null,"story_id":50314699,"text":"Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.
If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:30:41.000Z","created_at_i":1793449841,"id":50315559,"options":[],"parent_id":50315167,"points":null,"story_id":50314699,"text":"If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.
We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.","title":null,"type":"comment","url":null},{"author":"dist-epoch","children":[],"created_at":"2026-10-31T12:40:59.000Z","created_at_i":1793450459,"id":50315641,"options":[],"parent_id":50315167,"points":null,"story_id":50314699,"text":"I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T11:47:11.000Z","created_at_i":1793447231,"id":50315167,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"> able to take over anyone's account simply by sending them a link
dont click links people
that'll be $500k for the security training pls","title":null,"type":"comment","url":null},{"author":"dumberquestions","children":[{"author":"lifeisloving","children":[],"created_at":"2026-10-31T12:17:47.000Z","created_at_i":1793449067,"id":50315437,"options":[],"parent_id":50315175,"points":null,"story_id":50314699,"text":"This one is particularly bad, like they probably made $7500 (not much tbh) for p1, atleast spend a few hours to write the blog post.","title":null,"type":"comment","url":null},{"author":"zx8080","children":[{"author":"loveparade","children":[],"created_at":"2026-10-31T12:26:30.000Z","created_at_i":1793449590,"id":50315516,"options":[],"parent_id":50315439,"points":null,"story_id":50314699,"text":"For the LLMs so they get new training data","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:17:50.000Z","created_at_i":1793449070,"id":50315439,"options":[],"parent_id":50315175,"points":null,"story_id":50314699,"text":"For who?","title":null,"type":"comment","url":null},{"author":"armcat","children":[{"author":"bookofjoe","children":[],"created_at":"2026-10-31T15:21:25.000Z","created_at_i":1793460085,"id":50316976,"options":[],"parent_id":50316610,"points":null,"story_id":50314699,"text":"[2] https://bookofjoe2.blogspot.com/","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:38:43.000Z","created_at_i":1793457523,"id":50316610,"options":[],"parent_id":50315175,"points":null,"story_id":50314699,"text":"I actually still write my own blog [1] :sweat_smile:
Pure html by hand, using vim. No frameworks, no nothing, single stylesheet. I think there are a few others around here that still do this.
[1] https://armincat.com/","title":null,"type":"comment","url":null},{"author":"trungto","children":[],"created_at":"2026-10-31T15:13:28.000Z","created_at_i":1793459608,"id":50316898,"options":[],"parent_id":50315175,"points":null,"story_id":50314699,"text":"For my personal blog [0], I am still writing without LLM assistance. The goal is to test how well I understand the topic I am writing about, as well as to improve my own writing.
[0] https://trung.to","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T11:48:33.000Z","created_at_i":1793447313,"id":50315175,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Does no one write their own blogs anymore?","title":null,"type":"comment","url":null},{"author":"lxgr","children":[{"author":"albert_e","children":[{"author":"lxgr","children":[],"created_at":"2026-10-31T20:36:44.000Z","created_at_i":1793479004,"id":50319929,"options":[],"parent_id":50316938,"points":null,"story_id":50314699,"text":"Sounds similar, but the problem is exactly that I don\u2019t think there\u2019s any way to disconnect such a session, nor to even see that it is connected to my computer in the first place. There\u2019s a small notice when initially starting it on the mac, that\u2019s it.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:17:49.000Z","created_at_i":1793459869,"id":50316938,"options":[],"parent_id":50315324,"points":null,"story_id":50314699,"text":"Claude Code terminal has "remote control" option activated via /rc command. -- somewhat similar in that it still runs the session on the PC/Mac but allows the Claude authenticated user to access the session via internet / app
I am guessing this ChatGPT functionality is a similar Codex feature?
But this session is disconnected when the conversation is /exit ed","title":null,"type":"comment","url":null},{"author":"randomblock1","children":[],"created_at":"2026-11-01T00:25:21.000Z","created_at_i":1793492721,"id":50321608,"options":[],"parent_id":50315324,"points":null,"story_id":50314699,"text":"On the Work environment selector, "in the cloud" says "available on any device and can access your computer". Which seems pretty clear to me. (not that the labeling makes the security issue any better)","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:03:36.000Z","created_at_i":1793448216,"id":50315324,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad.
[1] https://news.ycombinator.com/item?id=50078284","title":null,"type":"comment","url":null},{"author":"usernametaken29","children":[{"author":"Pannoniae","children":[{"author":"wg0","children":[],"created_at":"2026-10-31T12:46:50.000Z","created_at_i":1793450810,"id":50315694,"options":[],"parent_id":50315477,"points":null,"story_id":50314699,"text":"Our industry has wasted hundreds of billions of dollars on this shit show called Microservices.
99.9% of shops need a monolith with same monolith having entry points for background workers and crons.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:22:27.000Z","created_at_i":1793449347,"id":50315477,"options":[],"parent_id":50315368,"points":null,"story_id":50314699,"text":"it's not like microservices fare better, when you introduce them, you've traded a hard problem for a hard problem and distributed computing...","title":null,"type":"comment","url":null},{"author":"elendilm","children":[{"author":"someothherguyy","children":[{"author":"brazukadev","children":[],"created_at":"2026-10-31T13:29:32.000Z","created_at_i":1793453372,"id":50316028,"options":[],"parent_id":50315904,"points":null,"story_id":50314699,"text":"LoC *IS* the metric. It is obviously not perfect tho but still the best one to compare software surface. Including to compare the same solution in different languages and platforms. The less code you need to manage, the less code you need to change and the less code you need to hold in your head to understand it (or in the LLM context nowadays).","title":null,"type":"comment","url":null},{"author":"cowlevel","children":[],"created_at":"2026-10-31T20:57:46.000Z","created_at_i":1793480266,"id":50320156,"options":[],"parent_id":50315904,"points":null,"story_id":50314699,"text":"More abstract code probably results in more high-abstraction-level bugs per LoC, but also less low-abstraction-level bugs so I'd guess it about cancels out to an even rate per LoC.
A single line in C++, Rust or Haskell can have a really subtle logic error. A single line in assembly can't, but it has that same likelihood of having a register allocation error instead, and when you add up all the many lines of assembly you probably still wrote the same number of logic errors as the C++ version.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T13:13:27.000Z","created_at_i":1793452407,"id":50315904,"options":[],"parent_id":50315560,"points":null,"story_id":50314699,"text":"i don't think LoC is the metric. sometimes fewer lines of code results in a larger attack surface through type coercion / widening, poor abstractions, hiding or stuffing behavior (modules that do everything), etc. to me, making code easy to understand, test, fuzz, and verify is more important. sometimes that requires more lines of code.","title":null,"type":"comment","url":null},{"author":"latexr","children":[],"created_at":"2026-10-31T14:01:28.000Z","created_at_i":1793455288,"id":50316286,"options":[],"parent_id":50315560,"points":null,"story_id":50314699,"text":"https://www.folklore.org/Negative_2000_Lines_Of_Code.html","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:30:41.000Z","created_at_i":1793449841,"id":50315560,"options":[],"parent_id":50315368,"points":null,"story_id":50314699,"text":"Reducing attack surface is a lesson for everyone. Newcomers are impressed by massive piles of code.
Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.","title":null,"type":"comment","url":null},{"author":"torben-friis","children":[{"author":"dahart","children":[{"author":"ebertucc","children":[{"author":"dahart","children":[],"created_at":"2026-10-31T15:41:45.000Z","created_at_i":1793461305,"id":50317198,"options":[],"parent_id":50316788,"points":null,"story_id":50314699,"text":"No difference, you\u2019re right. I meant polynomial not geometric. :P","title":null,"type":"comment","url":null},{"author":"cowlevel","children":[{"author":"dahart","children":[],"created_at":"2026-10-31T21:40:12.000Z","created_at_i":1793482812,"id":50320511,"options":[],"parent_id":50320116,"points":null,"story_id":50314699,"text":"Geometric is exponential; I goofed above. Geometric and exponential are sometimes used interchangeably, but sometimes people use geometric to refer to discrete intervals and exponential to refer to continuous functions.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T20:54:29.000Z","created_at_i":1793480069,"id":50320116,"options":[],"parent_id":50316788,"points":null,"story_id":50314699,"text":"geometric/polynomial: x^2, x^3, etc
exponential: 2^x, 3^x, etc
Everything in the second group eventually grows faster than everything in the first group, no matter how small and big you make the fixed numbers, so they are two different classes.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:01:48.000Z","created_at_i":1793458908,"id":50316788,"options":[],"parent_id":50316650,"points":null,"story_id":50314699,"text":"What's the difference? From what I'm reading online geometric is just the discrete version of exponential","title":null,"type":"comment","url":null},{"author":"codechicago277","children":[{"author":"dahart","children":[],"created_at":"2026-10-31T15:39:49.000Z","created_at_i":1793461189,"id":50317175,"options":[],"parent_id":50317155,"points":null,"story_id":50314699,"text":"That\u2019s quadratic, not exponential. 2^n != n^2","title":null,"type":"comment","url":null},{"author":"teiferer","children":[],"created_at":"2026-10-31T17:07:57.000Z","created_at_i":1793466477,"id":50317947,"options":[],"parent_id":50317155,"points":null,"story_id":50314699,"text":"And that's why sw eng interviews often have some basic math sprinkled in.","title":null,"type":"comment","url":null},{"author":"cowlevel","children":[],"created_at":"2026-10-31T20:55:20.000Z","created_at_i":1793480120,"id":50320128,"options":[],"parent_id":50317155,"points":null,"story_id":50314699,"text":"2 is an exponent but exponential growth means the exponent grows. 2 does not grow, it's always between 1 and 3 (unless you use an AI to do maths).","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:38:24.000Z","created_at_i":1793461104,"id":50317155,"options":[],"parent_id":50316650,"points":null,"story_id":50314699,"text":"\u201cSquare of the lines of code\u201d
Sounds exponential","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:43:41.000Z","created_at_i":1793457821,"id":50316650,"options":[],"parent_id":50315568,"points":null,"story_id":50314699,"text":"I\u2019m sure exponential is what parent meant, but geometric (edit: polynomial) is what actually happens, not exponential. Code complexity increases linearly when it doesn\u2019t interact with other features, and geometrically when it does. In the worst case, complexity increases as the square of lines of code. That is still very, very bad, but it\u2019s not exponential.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:31:46.000Z","created_at_i":1793449906,"id":50315568,"options":[],"parent_id":50315368,"points":null,"story_id":50314699,"text":"Did you mean exponentially? Logarithmic increase doesn't sound too bad.","title":null,"type":"comment","url":null},{"author":"rglover","children":[],"created_at":"2026-10-31T14:49:56.000Z","created_at_i":1793458196,"id":50316696,"options":[],"parent_id":50315368,"points":null,"story_id":50314699,"text":"I like LOEC: Lines of Effective Code.
Much easier to reason and make decisions if the bar is "yeah it exists, but is it effective relative to its intended purpose?" This weeds out buggy code as well as under performant code. If it's not effective (broken, too slow, etc), it either needs a refactor or thrown on the scrap pile.","title":null,"type":"comment","url":null},{"author":"pessimizer","children":[],"created_at":"2026-10-31T16:16:45.000Z","created_at_i":1793463405,"id":50317487,"options":[],"parent_id":50315368,"points":null,"story_id":50314699,"text":"> Now what about those millions of lines of code? Wasn\u2019t the agent swarm supposed to take care of it?
What's the joke? They're literally saying, every day, that this is true to a civilization endangering extent. They're making demands based on this, and politicians are taking up those demands.
And now they're paying bullshit $5K bug bounties for account-stealing exploits on their own platform. They should have paid more just the make the bug seem more grandiose; I don't know who let them get away with this - this is what happens when CEOs run their own PR I guess. It's basically an public announcement that they're total fakes.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:08:47.000Z","created_at_i":1793448527,"id":50315368,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Now what about those millions of lines of code? Wasn\u2019t the agent swarm supposed to take care of it?\nAll jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically\u2026 so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that\u2019s correct and adhere to established engineering standards over sensationalised \u201cwe built so much code\u201d promotional material.","title":null,"type":"comment","url":null},{"author":"yellow_lead","children":[{"author":"dist-epoch","children":[{"author":"dannyw","children":[],"created_at":"2026-10-31T13:21:24.000Z","created_at_i":1793452884,"id":50315953,"options":[],"parent_id":50315684,"points":null,"story_id":50314699,"text":"The "take over any instagram/meta account through their AI password reset chatbot" was going around and sold on shady forums for ~1 month before being patched.","title":null,"type":"comment","url":null},{"author":"throwaw12","children":[{"author":"petcat","children":[{"author":"pixl97","children":[{"author":"cowlevel","children":[],"created_at":"2026-10-31T20:51:08.000Z","created_at_i":1793479868,"id":50320080,"options":[],"parent_id":50317203,"points":null,"story_id":50314699,"text":"The president can't be a felon by definition, because it's legal to do absolutely anything if you're the president.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:42:37.000Z","created_at_i":1793461357,"id":50317203,"options":[],"parent_id":50316706,"points":null,"story_id":50314699,"text":"Don't worry, as more and more people get put of of work by AI the number of people willing to be felons will increase. Hell, they might even become president.","title":null,"type":"comment","url":null},{"author":"throwaw12","children":[{"author":"petcat","children":[{"author":"qup","children":[],"created_at":"2026-10-31T20:28:08.000Z","created_at_i":1793478488,"id":50319820,"options":[],"parent_id":50317545,"points":null,"story_id":50314699,"text":"The recent South Korean hacker reportedly wasn't a hacker at all, just asked Claude to handle it.
I'm not that kind of hacker, but I guarantee I could be, complete with an abliterated model on my local rig, in a few minutes. Claude would happily set it all up for me, too.
In reality, I suppose I'm about to keep my rig busy staying ahead of the hackers.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:24:02.000Z","created_at_i":1793463842,"id":50317545,"options":[],"parent_id":50317466,"points":null,"story_id":50314699,"text":"Anyone can "hack". It's not really a skill anymore.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:14:12.000Z","created_at_i":1793463252,"id":50317466,"options":[],"parent_id":50316706,"points":null,"story_id":50314699,"text":"I think people who can hack, also know where they can sell it","title":null,"type":"comment","url":null},{"author":"tadfisher","children":[],"created_at":"2026-10-31T18:49:09.000Z","created_at_i":1793472549,"id":50318854,"options":[],"parent_id":50316706,"points":null,"story_id":50314699,"text":"I am sure this is a crime, but what crime?","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:51:12.000Z","created_at_i":1793458272,"id":50316706,"options":[],"parent_id":50316301,"points":null,"story_id":50314699,"text":"Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable.
Most people don't want to be felons.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:02:35.000Z","created_at_i":1793455355,"id":50316301,"options":[],"parent_id":50315684,"points":null,"story_id":50314699,"text":"then server side vulnerabilities should not be reported, instead sell the data, more profitable","title":null,"type":"comment","url":null},{"author":"hashstring","children":[],"created_at":"2026-11-01T01:51:22.000Z","created_at_i":1793497882,"id":50322049,"options":[],"parent_id":50315684,"points":null,"story_id":50314699,"text":"Technically this is what you\u2019d call a client-side vuln, but yes, server-side as in cloud.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:45:47.000Z","created_at_i":1793450747,"id":50315684,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"This is a pet peeve of tptacek:
> server-side vulnerabilities are worth very little, because they quickly get patched.","title":null,"type":"comment","url":null},{"author":"thatsabadlook","children":[{"author":"varispeed","children":[{"author":"weird-eye-issue","children":[],"created_at":"2026-10-31T14:21:25.000Z","created_at_i":1793456485,"id":50316469,"options":[],"parent_id":50316397,"points":null,"story_id":50314699,"text":"Just imagine what the press would be when somebody breaks that NDA","title":null,"type":"comment","url":null},{"author":"layer8","children":[{"author":"varispeed","children":[],"created_at":"2026-10-31T17:27:03.000Z","created_at_i":1793467623,"id":50318107,"options":[],"parent_id":50316649,"points":null,"story_id":50314699,"text":"That incentive works both ways. For instance employee sneaking in a security hole and then selling it to a mate so they can collect the bounty.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:43:35.000Z","created_at_i":1793457815,"id":50316649,"options":[],"parent_id":50316397,"points":null,"story_id":50314699,"text":"The bounty payouts must be public in order to serve as an incentive.","title":null,"type":"comment","url":null},{"author":"goodmythical","children":[],"created_at":"2026-10-31T15:17:58.000Z","created_at_i":1793459878,"id":50316939,"options":[],"parent_id":50316397,"points":null,"story_id":50314699,"text":">should be paid multiple years of a high end vuln researcher salary per single discovery
What? Why would anyone work at a company paying them that much less than they pay the contractors?","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:12:53.000Z","created_at_i":1793455973,"id":50316397,"options":[],"parent_id":50315945,"points":null,"story_id":50314699,"text":"Should be given $5-10million under NDA. No headlines.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T13:19:25.000Z","created_at_i":1793452765,"id":50315945,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.","title":null,"type":"comment","url":null},{"author":"dgellow","children":[{"author":"amelius","children":[{"author":"baxtr","children":[],"created_at":"2026-10-31T15:08:54.000Z","created_at_i":1793459334,"id":50316862,"options":[],"parent_id":50316758,"points":null,"story_id":50314699,"text":"They should have paid in tokens?","title":null,"type":"comment","url":null},{"author":"tescreal","children":[{"author":"hxugufjfjf","children":[{"author":"Forgeties79","children":[],"created_at":"2026-10-31T21:41:35.000Z","created_at_i":1793482895,"id":50320525,"options":[],"parent_id":50317584,"points":null,"story_id":50314699,"text":"AI evangelists would\u2019ve latched on to it already and would be using it to preach the good word.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:29:25.000Z","created_at_i":1793464165,"id":50317584,"options":[],"parent_id":50317257,"points":null,"story_id":50314699,"text":"Who says they don't? And if they don't, maybe its because others are using their hard-earned money to buy tokens from them to do it, so they don't really have to.","title":null,"type":"comment","url":null},{"author":"user43928","children":[],"created_at":"2026-10-31T16:46:04.000Z","created_at_i":1793465164,"id":50317737,"options":[],"parent_id":50317257,"points":null,"story_id":50314699,"text":"Surely with all their security programs, they would run testing on the ChatGPT implementation.
I speculate that the AI didn't find this and that human effort and intuition for where to look were needed to find this vulnerability.","title":null,"type":"comment","url":null},{"author":"DeepSeaTortoise","children":[{"author":"8note","children":[],"created_at":"2026-11-01T01:12:26.000Z","created_at_i":1793495546,"id":50321849,"options":[],"parent_id":50318078,"points":null,"story_id":50314699,"text":"thats reasonably the state of anthropics code output as well - not much care and polish","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T17:23:54.000Z","created_at_i":1793467434,"id":50318078,"options":[],"parent_id":50317257,"points":null,"story_id":50314699,"text":"Having bit the bullet, I found OAI's models actually quite helpful and most of their offering half-decent. But their whole German website was incredibly concerning and the only reason I went for it was people claiming they're not far behind Anthropic on coding and generally superior for everyday tasks like coming up with recipes to cook from your leftovers.
Like half of the website was dysfunctiona and translations incredibly bad to the point of being nonsensical. That is if you were able to read them at all, because many just went off screen. Like, that's what your evil competitor does to your website after hijacking the domain, not you yourself, ffs","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:48:12.000Z","created_at_i":1793461692,"id":50317257,"options":[],"parent_id":50316758,"points":null,"story_id":50314699,"text":"If that is so, why doesn't OAI have a swarm doing this around the clock?","title":null,"type":"comment","url":null},{"author":"dgellow","children":[],"created_at":"2026-10-31T16:20:40.000Z","created_at_i":1793463640,"id":50317520,"options":[],"parent_id":50316758,"points":null,"story_id":50314699,"text":"A bounty amount is related to the blast radius and overall impact, not the effort required to find the issue","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:57:19.000Z","created_at_i":1793458639,"id":50316758,"options":[],"parent_id":50316244,"points":null,"story_id":50314699,"text":"But on the other hand, you can use AI now to find those vulnerabilities.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T13:57:11.000Z","created_at_i":1793455031,"id":50316244,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"That\u2019s so low. That\u2019s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it\u2019s just ridiculous coming from a large company like OpenAI","title":null,"type":"comment","url":null},{"author":"jryle70","children":[{"author":"yeahsure","children":[{"author":"jryle70","children":[],"created_at":"2026-10-31T16:24:10.000Z","created_at_i":1793463850,"id":50317546,"options":[],"parent_id":50317469,"points":null,"story_id":50314699,"text":"Were they not right? Just like money giving you some runway but will run out, the exposure is still only a leveler, it's still up to you to take advantage of it.
Also, they were not OpenAI.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:14:22.000Z","created_at_i":1793463262,"id":50317469,"options":[],"parent_id":50316335,"points":null,"story_id":50314699,"text":"Yeah... idk, sounds like when I was starting out almost 30 years ago my clients constantly lowballed me saying "but think of the exposition! this project will give you" lol","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:06:01.000Z","created_at_i":1793455561,"id":50316335,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"OpenAI acknowledging and fixing the bug is worth millions","title":null,"type":"comment","url":null},{"author":"varispeed","children":[{"author":"siva7","children":[{"author":"cowlevel","children":[],"created_at":"2026-10-31T20:51:35.000Z","created_at_i":1793479895,"id":50320085,"options":[],"parent_id":50316511,"points":null,"story_id":50314699,"text":"50 hours at $100/hour? To write a straightforward vuln report with AI?","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:26:42.000Z","created_at_i":1793456802,"id":50316511,"options":[],"parent_id":50316394,"points":null,"story_id":50314699,"text":"that wouldn't be the time worth of many people here to make the security report for OAI..","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:12:12.000Z","created_at_i":1793455932,"id":50316394,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.","title":null,"type":"comment","url":null},{"author":"windexh8er","children":[{"author":"throwaway98797","children":[{"author":"Black616Angel","children":[],"created_at":"2026-10-31T15:30:57.000Z","created_at_i":1793460657,"id":50317082,"options":[],"parent_id":50316900,"points":null,"story_id":50314699,"text":"Yeah, and some people just want the multi-billion dollar company that is currently destroying the planet while also permanently crippling social connections to just stop.","title":null,"type":"comment","url":null},{"author":"odyssey7","children":[{"author":"codechicago277","children":[{"author":"whamlastxmas","children":[],"created_at":"2026-10-31T15:43:04.000Z","created_at_i":1793461384,"id":50317210,"options":[],"parent_id":50317137,"points":null,"story_id":50314699,"text":"Only if you don't believe the means justify the ends. Not saying I believe that myself","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:36:10.000Z","created_at_i":1793460970,"id":50317137,"options":[],"parent_id":50317090,"points":null,"story_id":50314699,"text":"This isn\u2019t one of those times.","title":null,"type":"comment","url":null},{"author":"phoghed","children":[{"author":"BalinKing","children":[{"author":"OoooooooO","children":[],"created_at":"2026-10-31T18:14:14.000Z","created_at_i":1793470454,"id":50318493,"options":[],"parent_id":50317620,"points":null,"story_id":50314699,"text":"Citing a fantasy novel to prove your point doesn't add anything to the discussion.","title":null,"type":"comment","url":null},{"author":"RHSeeger","children":[],"created_at":"2026-10-31T18:52:45.000Z","created_at_i":1793472765,"id":50318893,"options":[],"parent_id":50317620,"points":null,"story_id":50314699,"text":"But some would argue that reducing the amount of resources and power available to someone who has immense amounts of both and is causing great harm to society as a whole - is ethical.","title":null,"type":"comment","url":null},{"author":"bsoles","children":[],"created_at":"2026-11-01T03:04:30.000Z","created_at_i":1793502270,"id":50322366,"options":[],"parent_id":50317620,"points":null,"story_id":50314699,"text":"Citing Leviticus for moral guidance is rich. Should we also kill people having affairs? (Leviticus 20:10).","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:32:49.000Z","created_at_i":1793464369,"id":50317620,"options":[],"parent_id":50317474,"points":null,"story_id":50314699,"text":"On the contrary, many (including myself) would argue that "the victim's amount of money/power" has absolutely no ethical relevance: "You shall do no injustice in judgment; you shall not be partial to the poor nor defer to the great, but you are to judge your neighbor fairly" (Leviticus 19:15).","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:14:45.000Z","created_at_i":1793463285,"id":50317474,"options":[],"parent_id":50317090,"points":null,"story_id":50314699,"text":"Yes, you have a moral obligation to Sam Altman\u2019s trillion dollar business.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:31:27.000Z","created_at_i":1793460687,"id":50317090,"options":[],"parent_id":50316900,"points":null,"story_id":50314699,"text":"True, however:
Ethics and legal requirements shouldn\u2019t be conflated.
There are times when ethics are a higher standard than what the law requires, and in that case the ethics are no less important.","title":null,"type":"comment","url":null},{"author":"tonyedgecombe","children":[{"author":"TheRoque","children":[],"created_at":"2026-10-31T16:12:35.000Z","created_at_i":1793463155,"id":50317452,"options":[],"parent_id":50317122,"points":null,"story_id":50314699,"text":"I don't think so, businesses like Zerodium bought zero days in plain sight and I don't think they faced legal consequences. They don't operate anymore though. So basically I'd say it depends who you sell it to and how.","title":null,"type":"comment","url":null},{"author":"echoangle","children":[{"author":"tadfisher","children":[{"author":"echoangle","children":[],"created_at":"2026-10-31T18:59:31.000Z","created_at_i":1793473171,"id":50318976,"options":[],"parent_id":50318870,"points":null,"story_id":50314699,"text":"I'm not sure but if negligence is punishable too for facilitation, it should stick, right? I think it's reasonable to expect that most buyers of exploits try to use them in illegal ways (or are feds acting like that to catch you).","title":null,"type":"comment","url":null},{"author":"cowlevel","children":[],"created_at":"2026-10-31T20:16:13.000Z","created_at_i":1793477773,"id":50319697,"options":[],"parent_id":50318870,"points":null,"story_id":50314699,"text":"They won't have to get you for facilitating the later crime, they can get you for testing the exploit on your own account, which is also a crime since OpenAI's computer system is involved.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T18:50:28.000Z","created_at_i":1793472628,"id":50318870,"options":[],"parent_id":50317477,"points":null,"story_id":50314699,"text":"Pretty sure you need actual knowledge of a planned crime for that to stick. But I'm also sure the defense will be expensive.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:15:01.000Z","created_at_i":1793463301,"id":50317477,"options":[],"parent_id":50317122,"points":null,"story_id":50314699,"text":"Facilitation of a crime is a crime too. So I think in the US and most western countries, yes. At least if it gets used illegally later.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:34:54.000Z","created_at_i":1793460894,"id":50317122,"options":[],"parent_id":50316900,"points":null,"story_id":50314699,"text":"Is it criminal to sell an exploit?","title":null,"type":"comment","url":null},{"author":"blurbleblurble","children":[{"author":"dbspin","children":[],"created_at":"2026-10-31T16:12:06.000Z","created_at_i":1793463126,"id":50317445,"options":[],"parent_id":50317372,"points":null,"story_id":50314699,"text":"This isn't like stealing from a business. These are individuals most private conversations, potentially including their bank accounts etc. Poverty is no defence - and yes, I've spent a great deal of my life barely scraping by. You'll find poor people are significantly less tolerant of theft, especially from individuals, than rich. Whether that evidences the theft inherent in most forms of wealth generation I'll leave up to the reader.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:01:47.000Z","created_at_i":1793462507,"id":50317372,"options":[],"parent_id":50316900,"points":null,"story_id":50314699,"text":"If only poverty were so simple","title":null,"type":"comment","url":null},{"author":"oth001","children":[],"created_at":"2026-10-31T16:47:39.000Z","created_at_i":1793465259,"id":50317762,"options":[],"parent_id":50316900,"points":null,"story_id":50314699,"text":"Ah yes, OpenAI, the poster child for ethics","title":null,"type":"comment","url":null},{"author":"windexh8er","children":[],"created_at":"2026-10-31T18:31:10.000Z","created_at_i":1793471470,"id":50318650,"options":[],"parent_id":50316900,"points":null,"story_id":50314699,"text":"Treating people and businesses ethically that don't reciprocate doesn't work, clearly. Those people and businesses cry in their milk while they do exactly the same thing. There are no ethics in play here.
But, hey if you want to defend billionaire narcissists that are destroying our planet and trying to take computing freedoms then I guess: you do you.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:13:41.000Z","created_at_i":1793459621,"id":50316900,"options":[],"parent_id":50316655,"points":null,"story_id":50314699,"text":"some people don\u2019t want to be criminals as a matter of ethics
but hey you do you","title":null,"type":"comment","url":null},{"author":"rootnod3","children":[],"created_at":"2026-10-31T17:20:25.000Z","created_at_i":1793467225,"id":50318057,"options":[],"parent_id":50316655,"points":null,"story_id":50314699,"text":"2 trillion $ companies should have the money to pay for these exploits. If they don\u2019t, go tucking exploit them. If they don\u2019t give a fuck about stealing knowledge from copyrighted material and private git repos, light em up.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T14:43:56.000Z","created_at_i":1793457836,"id":50316655,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.","title":null,"type":"comment","url":null},{"author":"kamban","children":[{"author":"zxilly","children":[],"created_at":"2026-10-31T17:57:47.000Z","created_at_i":1793469467,"id":50318362,"options":[],"parent_id":50317283,"points":null,"story_id":50314699,"text":"To be fair, based on the profit margins indicated in DeepSeek\u2019s reports, a $500 API credit might only cost them $5 to provide.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:51:02.000Z","created_at_i":1793461862,"id":50317283,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"They have just announced free API credits for Pro plan users up to $500 per month. Irony.","title":null,"type":"comment","url":null},{"author":"ibaikov","children":[{"author":"pvtmert","children":[],"created_at":"2026-10-31T16:37:22.000Z","created_at_i":1793464642,"id":50317655,"options":[],"parent_id":50317606,"points":null,"story_id":50314699,"text":"Typical $MSFT behavior, I can see why NightmareEclipse (ie. YellowKey zero-day exploit) got released without prior fix.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:31:45.000Z","created_at_i":1793464305,"id":50317606,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"I took over user accounts in Microsoft Copilot (there are caveats but still), and they asked me to provide additional information of the exploit (they wanted a video) and before I sent it they fixed the vulnerability, didn't pay me a cent. Fair? Idk.","title":null,"type":"comment","url":null},{"author":"Catloafdev","children":[{"author":"Forgeties79","children":[{"author":"andai","children":[{"author":"16bitvoid","children":[],"created_at":"2026-11-01T04:31:58.000Z","created_at_i":1793507518,"id":50322721,"options":[],"parent_id":50322708,"points":null,"story_id":50314699,"text":"And only about 5% (50M, last time it was reported) of them pay. The vast majority of those are using the free plan.","title":null,"type":"comment","url":null}],"created_at":"2026-11-01T04:28:24.000Z","created_at_i":1793507304,"id":50322708,"options":[],"parent_id":50319231,"points":null,"story_id":50314699,"text":"They have 1 billion active users.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T19:25:34.000Z","created_at_i":1793474734,"id":50319231,"options":[],"parent_id":50317858,"points":null,"story_id":50314699,"text":"Because they shouldn\u2019t be worth that tbh. They are a cash burning operation hoping to get what they can before the music stops.","title":null,"type":"comment","url":null},{"author":"fsckboy","children":[],"created_at":"2026-10-31T19:34:45.000Z","created_at_i":1793475285,"id":50319318,"options":[],"parent_id":50317858,"points":null,"story_id":50314699,"text":"A company worth trillions does not have trillions, that is the expectation for what it will be worth in the future based on money it has already spent and will need to keep spending.
Moreover, that translates to "it's actually carrying a huge nut* that puts extremely intense pressure on the company to figure out how to make as much money as possible as soon as possible."
(*nut is a slang word from loan sharking that has been adopted by (personal et al) finance people. It means "how much do you owe each month?" in the sense of, if you want to do a startup, advisors could ask, "what's your nut, and how much do you have left to self-invest?" Because monthly expense can be combined to a lump sum, it can also mean the size of the overall loan where the monthly interest is called the vig, "as long youze got da nut, you owe me da vig;" from vigorish, which would also require an etymology, but I'm assuming it's the word vigor combined with licorice meaning bitter tasting medicine, and nut because squirrels busy themselves carrying nuts.)
----
and if we can... and remember flame-prone people, if you reject the "can" premise, then the rest of the argument goes away, and you don't need to dispute it, you just say "you can't nuff said"; people here frequently seem challenged by propositions.
so, if we can...loosely describe the attitude you show here toward high market cap companies to be compatible with "left" or "socialist" or "populist" views shared by many others here, then I'll point out that at the same time wanting higher market prices paid for bounties because 'sploits are so expensive, is actually advocating for the same dread capitalist market based solution that leads to trillion dollar companies that never even had a trillion to begin with.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T16:57:47.000Z","created_at_i":1793465867,"id":50317858,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.","title":null,"type":"comment","url":null},{"author":"zeroq","children":[],"created_at":"2026-11-01T00:01:04.000Z","created_at_i":1793491264,"id":50321471,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"It's a complicated issue in current LLM world where every day is a zero day, but fuck me sideways, company that claims to be worth trillion of dollars paying 5k for such an exploit is insulting at best.
It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.
I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.","title":null,"type":"comment","url":null},{"author":"alfiedotwtf","children":[],"created_at":"2026-11-01T00:19:13.000Z","created_at_i":1793492353,"id":50321570,"options":[],"parent_id":50315474,"points":null,"story_id":50314699,"text":"The buyer of your second vulnerability all depends on how you\u2019re treated for your first vulnerability","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:22:04.000Z","created_at_i":1793449324,"id":50315474,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.","title":null,"type":"comment","url":null},{"author":"marwaneet","children":[{"author":"steve1977","children":[],"created_at":"2026-10-31T12:27:39.000Z","created_at_i":1793449659,"id":50315527,"options":[],"parent_id":50315488,"points":null,"story_id":50314699,"text":"Production scale is not production grade I guess...","title":null,"type":"comment","url":null},{"author":"brabel","children":[],"created_at":"2026-10-31T13:39:54.000Z","created_at_i":1793453994,"id":50316101,"options":[],"parent_id":50315488,"points":null,"story_id":50314699,"text":"The post seems to be talking about a html injection via a postMessage call where the receiver didn\u2019t check who sent the message, which is a well known vulnerability entry point. Did I miss where OAuth had anything to do with this??","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T12:23:47.000Z","created_at_i":1793449427,"id":50315488,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Another classic OAuth implementation failure. Mismanaging the state parameter or leaking tokens via referer headers in redirects is Security 101. Wild to see this in a production environment of this scale.","title":null,"type":"comment","url":null},{"author":"atrokhymchuk","children":[],"created_at":"2026-10-31T12:25:48.000Z","created_at_i":1793449548,"id":50315511,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"if only they had some sort of cybersecurity state of the art thing...","title":null,"type":"comment","url":null},{"author":"monster_truck","children":[],"created_at":"2026-10-31T13:11:12.000Z","created_at_i":1793452272,"id":50315883,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"only $5000 for this, lmao. It should be $50k out of pure shame. If they don't make these things hurt just a little they're never going to take following best practices seriously enough. There will be 9 more anyways.
Meanwhile the actual user of the account probably has to sign in using a yubikey because they get "CyBeRsEcRuItY aLeRtS" when they try to update node in their project to fix a crash and have to switch to daybreak blue to continue (or attempt to trick the normal models into doing it and risk getting autobanned)","title":null,"type":"comment","url":null},{"author":"6thbit","children":[],"created_at":"2026-10-31T13:47:12.000Z","created_at_i":1793454432,"id":50316169,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Appreciate the incremental write up building up the scope of the poc.
I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.","title":null,"type":"comment","url":null},{"author":"nickphx","children":[],"created_at":"2026-10-31T14:37:56.000Z","created_at_i":1793457476,"id":50316603,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"why didnt the black box of bullshit company detect this? for a group that touts every inane 'discovery' with hyperbolic bullshit, they really fall short on delivering anything of actual value, just rehashed bullshit.","title":null,"type":"comment","url":null},{"author":"Kuyawa","children":[{"author":"tsunamifury","children":[],"created_at":"2026-10-31T15:09:44.000Z","created_at_i":1793459384,"id":50316868,"options":[],"parent_id":50316856,"points":null,"story_id":50314699,"text":"I think you know that the mentality of a company like this is \u201csecurity is a risk but not a reward and whoever captures the reward kills everyone else\u201d","title":null,"type":"comment","url":null},{"author":"cbsks","children":[{"author":"stavros","children":[],"created_at":"2026-10-31T17:30:41.000Z","created_at_i":1793467841,"id":50318140,"options":[],"parent_id":50317099,"points":null,"story_id":50314699,"text":"Over the probability that you'll find something.","title":null,"type":"comment","url":null},{"author":"aprilthird2021","children":[],"created_at":"2026-10-31T19:48:05.000Z","created_at_i":1793476085,"id":50319427,"options":[],"parent_id":50317099,"points":null,"story_id":50314699,"text":"Makes negative sense. If it were that easy, OpenAI wouldn't have any bugs bc they could just run agents to exploit their own stuff and then fix all their bugs.
This bug could not be found by just asking an AI "find bugs in ChatGPT", that's why it was reported through a bug bounty programs and that's why it should be worth more than $5k","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:32:24.000Z","created_at_i":1793460744,"id":50317099,"options":[],"parent_id":50316856,"points":null,"story_id":50314699,"text":"I wonder if the new economics of finding bugs means that they pay the amount they think the tokens cost to find it.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:08:29.000Z","created_at_i":1793459309,"id":50316856,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"$5000 is a joke. They pay millions to their top devs and still have more holes than a colander so a nice guy shows you a huge opening in your platform and all you can give him is a pat on the shoulder? Did you fire your top devs and hire that guy for a million bucks plus options? Did you sue the security firm you paid millions to audit the issues?
I really hope they get hacked and crash down burning in flames like the Hindenburg","title":null,"type":"comment","url":null},{"author":"jwpapi","children":[{"author":"aprilthird2021","children":[],"created_at":"2026-10-31T19:49:34.000Z","created_at_i":1793476174,"id":50319438,"options":[],"parent_id":50317315,"points":null,"story_id":50314699,"text":"But couldn't they just turn around and sell this hackers for much more money?","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T15:54:40.000Z","created_at_i":1793462080,"id":50317315,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"I think there was another HN discussion about it re bounty value and as far as I remember the issue is not that big companies are greedy in that case, but rather that over time it\u2019s strategically better to have lower bounties so less people are interested in it.
5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.","title":null,"type":"comment","url":null},{"author":"j9feng","children":[],"created_at":"2026-10-31T15:56:27.000Z","created_at_i":1793462187,"id":50317329,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Claude or Gemini didn\u2019t find the vulnerability on ChatGPT?","title":null,"type":"comment","url":null},{"author":"Yieldz","children":[],"created_at":"2026-10-31T16:39:25.000Z","created_at_i":1793464765,"id":50317682,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Sigh.\nWith how good Openai are good in programming frontier agents, they still have weak security. Hmmn, i'm short of words.","title":null,"type":"comment","url":null},{"author":"Zeruxe","children":[],"created_at":"2026-10-31T17:53:46.000Z","created_at_i":1793469226,"id":50318327,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"5k is nothing for the amount of headache you just saved them..","title":null,"type":"comment","url":null},{"author":"htk","children":[],"created_at":"2026-10-31T18:04:55.000Z","created_at_i":1793469895,"id":50318415,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"5k makes me think the next guy is gonna sell his exploit in the black market instead.","title":null,"type":"comment","url":null},{"author":"pllbnk","children":[],"created_at":"2026-10-31T18:36:06.000Z","created_at_i":1793471766,"id":50318704,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"It's exhilarating (for the lack of the knowledge of a better word) to see OpenAI and Anthropic starting getting hacked and getting a taste of their own medicine. Brings back hope that actual software engineering is not dead yet.","title":null,"type":"comment","url":null},{"author":"zahlman","children":[{"author":"cowlevel","children":[{"author":"morgaesis","children":[{"author":"mediaman","children":[],"created_at":"2026-10-31T23:25:48.000Z","created_at_i":1793489148,"id":50321253,"options":[],"parent_id":50320959,"points":null,"story_id":50314699,"text":"It does if LLMs are generally poor writers, which they currently are, because it is extremely difficult to RLVR essay quality.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T22:40:13.000Z","created_at_i":1793486413,"id":50320959,"options":[],"parent_id":50319676,"points":null,"story_id":50314699,"text":"Your conclusion does not follow from your premise.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T20:13:56.000Z","created_at_i":1793477636,"id":50319676,"options":[],"parent_id":50318963,"points":null,"story_id":50314699,"text":"It's AI written so of course it's hard to follow.","title":null,"type":"comment","url":null},{"author":"0c3ca83","children":[],"created_at":"2026-10-31T20:43:43.000Z","created_at_i":1793479423,"id":50320004,"options":[],"parent_id":50318963,"points":null,"story_id":50314699,"text":"They're writing for bots, not humans. This is a marketing piece. They're trying to get themselves to come up as the answer when people ask chatbots questions.
You're not the target audience of writing on the Internet anymore.","title":null,"type":"comment","url":null},{"author":"krackers","children":[],"created_at":"2026-11-01T00:04:35.000Z","created_at_i":1793491475,"id":50321489,"options":[],"parent_id":50318963,"points":null,"story_id":50314699,"text":"It's surprising that using JSONP in this way is even allowed. At one point google explicitly made sure to prevent this flavor of attack
https://stackoverflow.com/questions/2669690/why-does-google-...","title":null,"type":"comment","url":null},{"author":"kenmacd","children":[],"created_at":"2026-11-01T02:30:15.000Z","created_at_i":1793500215,"id":50322217,"options":[],"parent_id":50318963,"points":null,"story_id":50314699,"text":"hnslop (using salahadawi, using Pangram) puts this at 100% AI written, so that's probably why.
Report: https://www.salahadawi.com/hacker-news-ai-detector/50314699
hnslop: https://hnslop.nilsherzig.com/","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T18:58:21.000Z","created_at_i":1793473101,"id":50318963,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Something about the writing style here makes it hard for me to follow what actually happened. The section about JSONP for example seems to be explaining how JSONP works and how it's designed as an attempt to work around these attacks, but that explanation is then passed off as an explanation of how they bypassed the protection. And the whole premise seems to be about how manipulating the Preview content let them work through multiple defensive layers, but I don't see an explanation of how they directly controlled that content in the first place. I would have thought that the only control you have over the content of "an ordinary public ChatGPT share" is the prompt text, and that any migration of that text into "a small working webpage using its Preview feature" is up to the model deciding to generate that "HTML block" in response.","title":null,"type":"comment","url":null},{"author":"hridyaagrawal","children":[{"author":"itsafarqueue","children":[{"author":"verteu","children":[],"created_at":"2026-10-31T20:05:02.000Z","created_at_i":1793477102,"id":50319598,"options":[],"parent_id":50319232,"points":null,"story_id":50314699,"text":"For a company that truly cares about secure software, that seems like an ideal outcome.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T19:25:40.000Z","created_at_i":1793474740,"id":50319232,"options":[],"parent_id":50319177,"points":null,"story_id":50314699,"text":"My theory is vulns will never pay out big especially now, no matter how serious. Imagine they paid out $50k+ \u2014 it\u2019d spawn an industry doing nothing but.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T19:20:15.000Z","created_at_i":1793474415,"id":50319177,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"$5000 is a joke for a "P1" vuln","title":null,"type":"comment","url":null},{"author":"joshuamoyers","children":[{"author":"uniq7","children":[{"author":"pamcake","children":[{"author":"uniq7","children":[],"created_at":"2026-11-01T03:52:25.000Z","created_at_i":1793505145,"id":50322549,"options":[],"parent_id":50321586,"points":null,"story_id":50314699,"text":"Tell me one.","title":null,"type":"comment","url":null}],"created_at":"2026-11-01T00:21:25.000Z","created_at_i":1793492485,"id":50321586,"options":[],"parent_id":50319906,"points":null,"story_id":50314699,"text":"False dichotomy. There are plenty of other possible approaches outside of "having agent swarms randomly breaking in to environments and then marketing their services in the disclosure" and "do nothing".","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T20:35:03.000Z","created_at_i":1793478903,"id":50319906,"options":[],"parent_id":50319792,"points":null,"story_id":50314699,"text":"I don't want to defend them, but the alternative is that they do nothing and you don't know about the vulnerability until a bad actor exploits it (something easy and cheap nowadays).
I'm confused, would you welcome that more?","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T20:26:26.000Z","created_at_i":1793478386,"id":50319792,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"unrelated to this, but this company randomly reached out disclosing a vulnerability to us (test environment, synthetic tenant). on the one hand, thank you, it\u2019s patched. on the other - we do not have a bug bounty program and this is not welcome. having agent swarms randomly breaking in to environments and then marketing their services in the disclosure is not an ideal sales tactic, in addition to being illegal.","title":null,"type":"comment","url":null},{"author":"jiveturkey","children":[],"created_at":"2026-10-31T20:45:18.000Z","created_at_i":1793479518,"id":50320014,"options":[],"parent_id":50314699,"points":null,"story_id":50314699,"text":"Hex aka Parameter is an irresponsible company, on my blacklist. after they did an unsolicited pentest on us, we scheduled a call. joke of a team.
hilarious that their headline message, on every web page, is `Backed by YC`.
also, the product is way behind their competitors anyway.
really cool exploit they found here, but that doesn't make them a company worth doing business with.","title":null,"type":"comment","url":null}],"created_at":"2026-10-31T10:30:11.000Z","created_at_i":1793442611,"id":50314699,"options":[],"parent_id":null,"points":312,"story_id":50314699,"text":null,"title":"Do the math: How we took over ChatGPT accounts","type":"story","url":"https://www.parameter.ai/labs/we-found-a-gap-at-openai"}