4 ms·

Not sure dumping this on Twitter qualifies as responsible disclosure, but interesting find nonetheless.

• _fat_santa 4y ago
  I wouldn't call this a "hack", more like OpenAI left the door open and hoped no one would notice.
  • banannaise 4y ago
    They may not have been "hacking", but they definitely are a "hacker" so it's really a matter of semantics.
  • O__________O 4y ago
    It is; commonly called URL parameter tampering and it also possible to counter it: https://www.google.com/search?q=url+parameter+(vulnerability+OR+attack+OR+hacking+OR+tampering+OR+manipulation) https://www.google.com/search?q=url+parameter+(vulnerability...
    • textninja 4y ago
      That’s “hacking” in the same way as pressing a button on the elevator is trespassing.
      • O__________O 4y ago
        You’re welcome to limit your definition of hacking, I prefer to keep an open mind. Since you used an elevator as a metaphor, to me, it’s like opening an unlocked elevator control panel to reroute the signals to achieve a goal that’s not possible via a locked panel; for example, access a floor that normally would require a high security key. Easy, yes, an intended use of the system, no. Would doing so potently be trespassing? Depends on the context, but possibly, if not likely, yes.
      • TremendousJudge 4y ago
        That's an interesting example since some of the most popular DEFCON talks on youtube are about elevator hacking, which includes pressing buttons that are right there on the panel
        • O__________O 4y ago
          Example of hacks that require “only” pressing buttons: https://www.wikihow.com/Make-an-Elevator-an-Express-Elevator https://www.wikihow.com/Make-an-Elevator-an-Express-Elevator
        • textninja 4y ago
          That’s “hacking” in the same way as changing the page number parameter in a URL is hacking ;)
  • BlueTemplar 4y ago
    Just like walking into someone's home because they left the door open/unlocked, it might have legal consequences : "French journalist "hacks" govt by inputting correct URL, later fined $4,000+" https://arstechnica.com/tech-policy/2014/02/french-journalist-fined-4000-plus-for-publishing-public-documents/ https://arstechnica.com/tech-policy/2014/02/french-journalis...
• sp332 4y ago
  OpenAI published this to the internet. It's likely that anyone nefarious has already found this. Going public is up to the hacker. I'm sure OpenAI would prefer coordinated disclosure, but there's no reason to let them dictate what people do with information.
  • O__________O 4y ago
    That’s not how responsible disclosure works.
    • sp332 4y ago
      Yes, I know. Calling it "responsible disclosure" is weaselly and implies that anything else is irresponsible. I disagree.
      • O__________O 4y ago
        General topic is independent disclosure. If something is more responsible or irresponsible is dependent on the context. In this specific situation I not seeing any reason why publicly disclosing this prior to notifying OpenAI would have been more responsible. Am I missing something?
      • mindslight 4y ago
        The term is especially galling when it's applied to undermining a business model. This isn't at all like dropping a 0day on OpenSSH - individuals have zero responsibility for helping businesses maintain artificial restrictions.
      • rcoveson 4y ago
        I think I agree with you but I want to point out to any young up-and-comers reading this that you shouldn't just naively act like the world agrees, at least not in situations where you have a lot to lose and not much to fall back on. It's like piracy. Yes, intellectual property law is stupid and should be thwarted whenever possible, and we can talk like that all we want. Just be careful with your actions.
    • deleted 4y ago
• behnamoh 4y ago
  I wouldn't call OpenAI's behavior responsible either, so I guess this balances things out a little.