A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.

Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.

Wild to think a company supposedly worth a $trillion+ is doing shit like this.

I took over user accounts in Microsoft Copilot (there are caveats but still), and they asked me to provide additional information of the exploit (they wanted a video) and before I sent it they fixed the vulnerability, didn't pay me a cent. Fair? Idk.

That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI

Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.

We need an (official) third party, like an escrow. You report to them, they manage the talking with the company, they tell the judge you did nothing wrong because you reported to them, THEY use tables and shit to decide that such and such attack vector is worth this percentage of the company's revenue, this team would have received a hefty sum

This is a pet peeve of tptacek:

> server-side vulnerabilities are worth very little, because they quickly get patched.

It's a complicated issue in current LLM world where every day is a zero day, but fuck me sideways, company that claims to be worth trillion of dollars paying 5k for such an exploit is insulting at best.

It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.

I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.

I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.

The buyer of your second vulnerability all depends on how you’re treated for your first vulnerability

They have just announced free API credits for Pro plan users up to $500 per month. Irony.

OpenAI acknowledging and fixing the bug is worth millions

Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.

Claude Code terminal has "remote control" option activated via /rc command. -- somewhat similar in that it still runs the session on the PC/Mac but allows the Claude authenticated user to access the session via internet / app

I am guessing this ChatGPT functionality is a similar Codex feature?

But this session is disconnected when the conversation is /exit ed

On the Work environment selector, "in the cloud" says "available on any device and can access your computer". Which seems pretty clear to me. (not that the labeling makes the security issue any better)

For my personal blog [0], I am still writing without LLM assistance. The goal is to test how well I understand the topic I am writing about, as well as to improve my own writing.

[0] https://trung.to

This one is particularly bad, like they probably made $7500 (not much tbh) for p1, atleast spend a few hours to write the blog post.

I actually still write my own blog [1] :sweat_smile:

Pure html by hand, using vim. No frameworks, no nothing, single stylesheet. I think there are a few others around here that still do this.

[1] https://armincat.com/

I write mine, and will continue to do so, by hand. I would never consider letting an LLM touch my writing.

Posting frequency is another matter…

For who?

They're writing for bots, not humans. This is a marketing piece. They're trying to get themselves to come up as the answer when people ask chatbots questions.

You're not the target audience of writing on the Internet anymore.

It's AI written so of course it's hard to follow.

It's surprising that using JSONP in this way is even allowed. At one point google explicitly made sure to prevent this flavor of attack

https://stackoverflow.com/questions/2669690/why-does-google-...

hnslop (using salahadawi, using Pangram) puts this at 100% AI written, so that's probably why.

Report: https://www.salahadawi.com/hacker-news-ai-detector/50314699

hnslop: https://hnslop.nilsherzig.com/

I think you know that the mentality of a company like this is “security is a risk but not a reward and whoever captures the reward kills everyone else”

I wonder if the new economics of finding bugs means that they pay the amount they think the tokens cost to find it.

[flagged]

Did you mean exponentially? Logarithmic increase doesn't sound too bad.

it's not like microservices fare better, when you introduce them, you've traded a hard problem for a hard problem and distributed computing...

I like LOEC: Lines of Effective Code.

Much easier to reason and make decisions if the bar is "yeah it exists, but is it effective relative to its intended purpose?" This weeds out buggy code as well as under performant code. If it's not effective (broken, too slow, etc), it either needs a refactor or thrown on the scrap pile.

> Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it?

What's the joke? They're literally saying, every day, that this is true to a civilization endangering extent. They're making demands based on this, and politicians are taking up those demands.

And now they're paying bullshit $5K bug bounties for account-stealing exploits on their own platform. They should have paid more just the make the bug seem more grandiose; I don't know who let them get away with this - this is what happens when CEOs run their own PR I guess. It's basically an public announcement that they're total fakes.

Reducing attack surface is a lesson for everyone. Newcomers are impressed by massive piles of code.

Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.

My theory is vulns will never pay out big especially now, no matter how serious. Imagine they paid out $50k+ — it’d spawn an industry doing nothing but.

My latest project emails a magic link.

I'm trying not to have any important data to even lose, when I eventually get hacked.

We can all turn up our noses, like the other commenters in this thread, but every one of them is exposed. Negligence is a matter of degrees.

> please don’t login as me

Please don't drain my $6.5 billion in Dogecoin.

Been sayin this for years. Everybody in the world world: just BE COOL. Solves like every internet problem at once.

[flagged]

But couldn't they just turn around and sell this hackers for much more money?

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet

Also many emails from tech companies today:

- "sign in via one-time code."

- "Click here to see our latest update".

... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."

[0]: [redacted]

Thanks! Here, click on this link to get paid

[dead]

I don't want to defend them, but the alternative is that they do nothing and you don't know about the vulnerability until a bad actor exploits it (something easy and cheap nowadays).

I'm confused, would you welcome that more?

> this is not welcome

tough luck. with an attitude like that yngmi.

> illegal

do you think the russians, chinese, israelis, iranians, north koreans, and a million other profit motivated adversaries gaf about what is legal?

>sounds to me like coding ain't entirely solved yet after all...

Someone's getting a lump of coal from the Basilisk this year...

The post seems to be talking about a html injection via a postMessage call where the receiver didn’t check who sent the message, which is a well known vulnerability entry point. Did I miss where OAuth had anything to do with this??

Production scale is not production grade I guess...