Hacker News Reader

Comment by worldsavior | Hacker News Reader

It is open source. Your browser retrives all the JS and html sources. Even if it were somehow closed source, it doesn't really matter. You can view web requests and other, and see for yourself.

View on HN

What Just because you can see HTML and JS that THE BACKEND SENT doesn't mean you can see the actual logic (code)

This is a static website, no backend.

All logic is clientside in the downloaded JS and HTML. After the initial page load, it should send nothing to the backend of the website, only API calls to chatGPT API itself. There is no actual backend with logic, it only serves static HTML+JS+assets.

Theoretically, you should be able to block any outgoing connections to the website domain (after it loads all necessary HTML and JS), and it should still work fine. Saying "theoretically" because it might attempt delay-loading some static assets, but you get the idea. No idea how this specific website functions, as I haven't looked deep into it yet, but that's the principle behind "static websites" like this one.

The ability to reverse engineer the source through the browser doesn't make something qualify as open source anymore than reverse engineering a binary with some other tool.

I can view web requests but let's say on the 365th web request it sends my API key to an unknown location. How would I know if this was closed source?

Forgive me if I’m just being naive but couldn’t you look at the source from the browser dev tools?

Sure, if you're checking the first 365 requests or you get really lucky and just happen to look that time. Quite unlikely though.

It's not similar to a binary file, since re a binary file is a pain in the ass and looking at JS with some obfuscation is much easier.

Your example is valid, but it's like asking "how can I know that my iPhone doesn't record me while I'm sleeping?"

I trust apple over some random person on the internet.

Reply on news.ycombinator.com