OpenAI’s Bug Bounty Program | Hacker News Reader

OpenAI’s Bug Bounty Program

openai.com

37 pointsmfiguiere19 comments

This is for traditional software issues (e.g. chat history randomly showing for other people due to a Redis caching issue), not model issues.

> Issues related to the content of model prompts and responses are strictly out of scope, and will not be rewarded unless they have an additional directly verifiable security impact on an in-scope service

https://bugcrowd.com/openai

Interestingly, this means all the prompt hacks to convince ChatGPT to get around its restrictions are out of scope.

*unless you can get it to hack itself, then that would be in scope.

because nobody knows how to solve that

Why don't they use ChatGPT to find all the bugs?

Maybe they already did, and this "bug bounty program" is just for appearances.

I mean these people had random chats showing up in other user's windows, how much worse can chatgpt be?

The chat muxing issue wasn't great, but it was an understandable software error that any professional software engineer could have made. The AI alignment challenge is much more pertinent and under-attended.

> understandable software error that any professional software engineer could have made

Not really, no. I never heard, seen or experienced such an issue in any work environment. I did see it happen among wordpress level websites tho.

It’s stupidly common with “distributed micro services systems” that do a lot of caching.

Last year Klarna logged people in into other accounts because of some stupid caching issue too.

I don't to digress too much but I strongly belive y'all need to review your approach to caching. This kind of stuff is literarly unheard of among competent engineers. No insult meant, but this is hilarious.

as a soon-to-be-unemployable-human-knowledge-worker

I'd rather give away anything I spotted directly and freely to the blackhats

lack of perceived competence will lead to faster regulation

>lack of perceived competence will lead to faster regulation.

This is complete fantasy. Breaches at both Equifax and Facebook where results of incompetence and absolutely nothing was done.

> This is complete fantasy. Breaches at both Equifax and Facebook where results of incompetence and absolutely nothing was done.

you heard it here

the GDPR doesn't exist

GDPR is toothless. Next you’re going to tell us the Cookie banner worked out real well too or forcing a company to convert their devices to USBC. Wow big wins. Thanks EU!

The USB-C thing is a big win imo.

GDPR was toothless during the transition period. They are starting to hand out fines now.

Cookie banners suck, but also the EU didn’t mandate cookie banners. They are only a means to get consent. A bad one at that. A company that cares about the user will only set essential cookies until the user explicitly opts in to advertising/analytics/etc, perhaps in exchange for something. It could be a toggle in your account settings or a button in the footer. There’s no need for the implementation to be obtuse. Companies are just greedy. You should push back against their bad business practices.

USB-C is great. If all you use is a phone, then it may not seem like mandating USB-C changes much, but this is a big deal for camera equipment, radios, and other electronics.

Oh don't worry, if open ai's web product is any indication of how well ai performs with code, we are all safe.

Soooo many of our devs are going to take advantage of this: https://www.chatgpthackers.dev

Looking forward to it!

Reply on news.ycombinator.com