9 ms·

The disclosure is provides valuable information, but the introduction suggests someone else or «open-source» is to blame: >We took ChatGPT offline earlier this

The disclosure is provides valuable information, but the introduction suggests someone else or «open-source» is to blame: >We took ChatGPT offline earlier this week due to a bug in an open-source library which allowed some users to see titles from another active user’s chat history. Blaming an open-source library for a fault in closed-source product is simply unfair. The MIT licensed dependency explicitly comes without any warranties. After all, the bug went unnoticed until ChatGPT put it under pressure, and it was ChatGPT that failed to rule out the bug in their release QA.

voidfunc 4y ago
They're not blaming anyone. Objectively there was a bug in that library that caused the problem.
- Matl 4y ago
  Why mention it is open source then? What does that add?
  - fsckboy 4y ago
    "there was a bug in an outside library that we used" does not mention open source but has the same meaning, and would probably provoke the same complaints ("they're trying to blame somebody else for their problem"). In that case, though, they could say "look, we used a popular open source library because we had more faith that it would be better tested and correct" which would be a compliment to open source. That's essentially the information that we have. In today's world, who builds anything from anything close to stratch? embedded developers, probably come closest. It's no worse or better to say "there was a bug that our release uncovered." If they continue to announce as many details as possible, we as the audience can develop a sense whether they're creating bugs or just uncovering bugs we're glad to know about.
    - abujazar 4y ago
      I think it's fair to mention the bug originated in redis-py, but I don't find it relevant at all to mention «open-source» in the opening line of the public statement about the outage. Or «outside library» for that matter. It was ChatGPT release QA that failed, and then they failed to admit it.
      - tnzk 4y ago
        It might be redis-py originally and someone at public relations advised to replace it with something more general so that it would sound being nice.
      - fsckboy 4y ago
        "given enough eyeballs, all bugs are shallow" is a compliment to open source, and telling your users that you use open source is a positive reassurance on other dimensions as well; it's relevant, and the truth is always relevant; there's no harm in mentioning it. "Release early, release often" and "move fast and break things" are respected ideas that diminish the importance of QA. The more effective and efficient any QA you do is, yes, very valuable, and QA that finds broken things, all the better. But don't move slow is an OK compromise.
  - clnq 4y ago
    On the other hand, why overthink it?
  - xdavidliu 4y ago
    why not mention it? What does mentioning it subtract?
    - abujazar 4y ago
      «Open source» was in the opening line of the statement as if it was something to blame.
- abujazar 4y ago
  They're not blaming, legally speaking. But they're communicating that open source software caused their outage. OpenAI chose to use software that explicitly came without warranties, and are legally solely responsible for problems caused by open-source libraries they choose to include in their product.
  - LASR 4y ago
    I understand where you're coming from. But there is certainly an audience for this kind of post that would like to read about the objective source of the bug without connecting it to some expectations around responsibility. I read this post, and I don't see it assigning blame to anyone other than themselves. See this bit copied from the post: > Everyone at OpenAI is committed to protecting our users’ privacy and keeping their data safe. It’s a responsibility we take incredibly seriously. Unfortunately, this week we fell short of that commitment, and of our users’ expectations. We apologize again to our users and to the entire ChatGPT community and will work diligently to rebuild trust.
    - abujazar 4y ago
      The facts could be more clearly stated by defraining from stating open-source software as the cause.
    - int_19h 4y ago
      The questionable part is saying "open source". They refrained from naming the library, which is good; but then why bring up that one fact about it right after?
s3p 4y ago
Did you read the technical details? This was a bug in the way Redis-py handled requests that were cancelled before a response was returned to the user.
- manojlds 4y ago
  So? You own the stack. All that had to be said was there was a bug in the way requests were handled in a library. The open source part is not even needed.
  - lcuff 4y ago
    I think the mention of exactly where is useful to this audience. Other people using the same open-source library might realize --- oh, we've run into that bug but never realized it. Low probability, sure, but nonetheless.
    - acka 4y ago
      OpenAI could have simply named the library up front instead of stressing that it is open source. This would have alerted people who use the library while at the same time avoiding the suggestion that it being open source was part of the problem.
    - manojlds 4y ago
      They tweeted few days back there was a bug in an open source library. That's the main issue.
- abujazar 4y ago
  Yes, and this is still the sole responsibility of OpenAI. They chose to include redis-py without warranties and are responsible for their own QA on any product built on it.
- ipaddr 4y ago
  I reject the premise this is a bug. The author picked this implementation with whatever side effects. The author might want some requests to cancel in some situations. It's upto OpenAI to decide if the implementation works for their setup.
mirekrusin 4y ago
They are not suing anybody, just because it’s open source doesn’t mean talking about bugs is taboo. It reads to me like raw information, very good. They said they contacted authors helping with upstream bug fix. It’s great example how to deal with this kind of problems if anything to me.
- abujazar 4y ago
  I agree it's a good example – if not great. But considering OpenAI itself is as closed source as can be, mentioning open-source software as the cause of their outage in the very first line of their statement seems somewhat out of place. I don't think it's a coincidence that the open-source comes in the opening line while the acknowledgement to the Redis team is at the very end. Many outside of software engineering might read this as «open source caused OpenAI to crash».
  - random_cynic 4y ago
    Ironically, this sort of insane takes everywhere on the thread is causing more harm towards the image of open-source developers than OpenAI or anyone could ever do with their press release. It's important to mention whatever open-source library caused a bug because that could be happening in many other applications that are using it. That's basically one of the main points of open-source.
  - Angostura 4y ago
    What would your opening sentence have been? It’s a great opening sentence. Short, factual explanatory. You would have to be hypersensitive to object. As far as I can see, the whole thing is a reaction to OpenAI not being sufficiently open - which is a fine argument to have with them, but shouldn’t cloud judgement on the quality of this write-up
    - __del__ 4y ago
      i'm not the person you replied to, but i'm guessing maybe they'd have preferred: "We took ChatGPT offline earlier this week due to a bug in an external library which allowed some users to see titles from another active user’s chat history."
yieldcrv 4y ago
I prefer accuracy over placating your public relations ego The only counterpoint I would take is one related to the accuracy of what they wrote
manojlds 4y ago
Maybe they should let ChatGPT craft the postmortem
- andrethegiant 4y ago
  Maybe they already did
belter 4y ago
According to this is not fixed yet... https://github.com/redis/redis-py/issues/2624 https://github.com/redis/redis-py/issues/2624
hgsgm 4y ago
This shows that LLM AI, as dangerous as OpenAI says it is, cannot be entrusted to OpenAI for safeguarding its use.
SerCe 4y ago
Shifting the blame to open source isn't a good look. I like what Bryan Cantrill had to say about it: https://twitter.com/bcantrill/status/1638707484620902401 https://twitter.com/bcantrill/status/1638707484620902401
- abujazar 4y ago
  Spot on
- Angostura 4y ago
  The blame wasn’t “shifted”. The source of the bug was reported
- danielbln 4y ago
  https://twitter.com/danielbln/status/1639535353634643968?s=20 https://twitter.com/danielbln/status/1639535353634643968?s=2...
YPPH 4y ago
If someone asked ChatGPT to generate some code, then copy and pasted it mindlessly into their project, I wonder what OpenAI would think about the claim: "The bug was a result of faulty code produced by ChatGPT." Using an open source library is like copy and pasting code into your project. You assume responsibility for any pitfalls.
- colechristensen 4y ago
  I mean they’re pretty clear with their warnings about accuracy.
  - abujazar 4y ago
    Just like any author of MIT licensed open source software is clear about their license which clearly states they are not responsible in any way whatsoever for the shortcomings of their licensees.
- carlmr 4y ago
  Come to think of it, I think that's realistically going to happen a lot. It's going to be recursive blaming all the way down.
golergka 4y ago
The phrase you quoted doesn't blame anyone, it just shows causation. Causation and moral responsibility are not the same thing.
juunpp 4y ago
Damn open source! Those guys aren't living to their paychecks, I foresee staff cuts...
nialv7 4y ago
I am curious how you would have phrased it? Is there a way to accurately convey the root cause of the problem (the redis-py library) without sounding like trying to shift blame?
- pinkcan 4y ago
  there was a bug on our codebase...
  - Moru 4y ago
    But then you don't get the goodwill of helping the open-source library fixing the bug, contributing back to the community.
chaxor 4y ago
I understand and agree that framing open source as the issue is ridiculous. They may be redeemed though through the likely scenario that they didn't write this - GPT probably did. Perhaps their GPT doesn't like open source. :D
Caligatio 4y ago
I don't recall anyone advocating omitting the name log4j when that security bug dropped in 2021. How is that situation materially different from this? redis-py fixed the behavior so it's definitely not the case of working-as-intended. To be clear, I would be up in arms if OpenAI was trying to hold redis potentially legally responsible.

voidfunc 4y ago

They're not blaming anyone. Objectively there was a bug in that library that caused the problem.

Matl 4y ago
Why mention it is open source then? What does that add?
- fsckboy 4y ago
  "there was a bug in an outside library that we used" does not mention open source but has the same meaning, and would probably provoke the same complaints ("they're trying to blame somebody else for their problem"). In that case, though, they could say "look, we used a popular open source library because we had more faith that it would be better tested and correct" which would be a compliment to open source. That's essentially the information that we have. In today's world, who builds anything from anything close to stratch? embedded developers, probably come closest. It's no worse or better to say "there was a bug that our release uncovered." If they continue to announce as many details as possible, we as the audience can develop a sense whether they're creating bugs or just uncovering bugs we're glad to know about.
  - abujazar 4y ago
    I think it's fair to mention the bug originated in redis-py, but I don't find it relevant at all to mention «open-source» in the opening line of the public statement about the outage. Or «outside library» for that matter. It was ChatGPT release QA that failed, and then they failed to admit it.
    - tnzk 4y ago
      It might be redis-py originally and someone at public relations advised to replace it with something more general so that it would sound being nice.
    - fsckboy 4y ago
      "given enough eyeballs, all bugs are shallow" is a compliment to open source, and telling your users that you use open source is a positive reassurance on other dimensions as well; it's relevant, and the truth is always relevant; there's no harm in mentioning it. "Release early, release often" and "move fast and break things" are respected ideas that diminish the importance of QA. The more effective and efficient any QA you do is, yes, very valuable, and QA that finds broken things, all the better. But don't move slow is an OK compromise.
- clnq 4y ago
  On the other hand, why overthink it?
- xdavidliu 4y ago
  why not mention it? What does mentioning it subtract?
  - abujazar 4y ago
    «Open source» was in the opening line of the statement as if it was something to blame.
abujazar 4y ago
They're not blaming, legally speaking. But they're communicating that open source software caused their outage. OpenAI chose to use software that explicitly came without warranties, and are legally solely responsible for problems caused by open-source libraries they choose to include in their product.
- LASR 4y ago
  I understand where you're coming from. But there is certainly an audience for this kind of post that would like to read about the objective source of the bug without connecting it to some expectations around responsibility. I read this post, and I don't see it assigning blame to anyone other than themselves. See this bit copied from the post: > Everyone at OpenAI is committed to protecting our users’ privacy and keeping their data safe. It’s a responsibility we take incredibly seriously. Unfortunately, this week we fell short of that commitment, and of our users’ expectations. We apologize again to our users and to the entire ChatGPT community and will work diligently to rebuild trust.
  - abujazar 4y ago
    The facts could be more clearly stated by defraining from stating open-source software as the cause.
  - int_19h 4y ago
    The questionable part is saying "open source". They refrained from naming the library, which is good; but then why bring up that one fact about it right after?

s3p 4y ago

Did you read the technical details? This was a bug in the way Redis-py handled requests that were cancelled before a response was returned to the user.

manojlds 4y ago
So? You own the stack. All that had to be said was there was a bug in the way requests were handled in a library. The open source part is not even needed.
- lcuff 4y ago
  I think the mention of exactly where is useful to this audience. Other people using the same open-source library might realize --- oh, we've run into that bug but never realized it. Low probability, sure, but nonetheless.
  - acka 4y ago
    OpenAI could have simply named the library up front instead of stressing that it is open source. This would have alerted people who use the library while at the same time avoiding the suggestion that it being open source was part of the problem.
  - manojlds 4y ago
    They tweeted few days back there was a bug in an open source library. That's the main issue.
abujazar 4y ago
Yes, and this is still the sole responsibility of OpenAI. They chose to include redis-py without warranties and are responsible for their own QA on any product built on it.
ipaddr 4y ago
I reject the premise this is a bug. The author picked this implementation with whatever side effects. The author might want some requests to cancel in some situations. It's upto OpenAI to decide if the implementation works for their setup.

mirekrusin 4y ago

They are not suing anybody, just because it’s open source doesn’t mean talking about bugs is taboo. It reads to me like raw information, very good. They said they contacted authors helping with upstream bug fix. It’s great example how to deal with this kind of problems if anything to me.

abujazar 4y ago
I agree it's a good example – if not great. But considering OpenAI itself is as closed source as can be, mentioning open-source software as the cause of their outage in the very first line of their statement seems somewhat out of place. I don't think it's a coincidence that the open-source comes in the opening line while the acknowledgement to the Redis team is at the very end. Many outside of software engineering might read this as «open source caused OpenAI to crash».
- random_cynic 4y ago
  Ironically, this sort of insane takes everywhere on the thread is causing more harm towards the image of open-source developers than OpenAI or anyone could ever do with their press release. It's important to mention whatever open-source library caused a bug because that could be happening in many other applications that are using it. That's basically one of the main points of open-source.
- Angostura 4y ago
  What would your opening sentence have been? It’s a great opening sentence. Short, factual explanatory. You would have to be hypersensitive to object. As far as I can see, the whole thing is a reaction to OpenAI not being sufficiently open - which is a fine argument to have with them, but shouldn’t cloud judgement on the quality of this write-up
  - __del__ 4y ago
    i'm not the person you replied to, but i'm guessing maybe they'd have preferred: "We took ChatGPT offline earlier this week due to a bug in an external library which allowed some users to see titles from another active user’s chat history."

yieldcrv 4y ago

I prefer accuracy over placating your public relations ego The only counterpoint I would take is one related to the accuracy of what they wrote

manojlds 4y ago

Maybe they should let ChatGPT craft the postmortem

andrethegiant 4y ago
Maybe they already did

belter 4y ago

According to this is not fixed yet... https://github.com/redis/redis-py/issues/2624 https://github.com/redis/redis-py/issues/2624

hgsgm 4y ago

This shows that LLM AI, as dangerous as OpenAI says it is, cannot be entrusted to OpenAI for safeguarding its use.

SerCe 4y ago

Shifting the blame to open source isn't a good look. I like what Bryan Cantrill had to say about it: https://twitter.com/bcantrill/status/1638707484620902401 https://twitter.com/bcantrill/status/1638707484620902401

abujazar 4y ago
Spot on
Angostura 4y ago
The blame wasn’t “shifted”. The source of the bug was reported
danielbln 4y ago
https://twitter.com/danielbln/status/1639535353634643968?s=20 https://twitter.com/danielbln/status/1639535353634643968?s=2...

YPPH 4y ago

If someone asked ChatGPT to generate some code, then copy and pasted it mindlessly into their project, I wonder what OpenAI would think about the claim: "The bug was a result of faulty code produced by ChatGPT." Using an open source library is like copy and pasting code into your project. You assume responsibility for any pitfalls.

colechristensen 4y ago
I mean they’re pretty clear with their warnings about accuracy.
- abujazar 4y ago
  Just like any author of MIT licensed open source software is clear about their license which clearly states they are not responsible in any way whatsoever for the shortcomings of their licensees.
carlmr 4y ago
Come to think of it, I think that's realistically going to happen a lot. It's going to be recursive blaming all the way down.

golergka 4y ago

The phrase you quoted doesn't blame anyone, it just shows causation. Causation and moral responsibility are not the same thing.

juunpp 4y ago

Damn open source! Those guys aren't living to their paychecks, I foresee staff cuts...

nialv7 4y ago

I am curious how you would have phrased it? Is there a way to accurately convey the root cause of the problem (the redis-py library) without sounding like trying to shift blame?

pinkcan 4y ago
there was a bug on our codebase...
- Moru 4y ago
  But then you don't get the goodwill of helping the open-source library fixing the bug, contributing back to the community.

chaxor 4y ago

I understand and agree that framing open source as the issue is ridiculous. They may be redeemed though through the likely scenario that they didn't write this - GPT probably did. Perhaps their GPT doesn't like open source. :D

Caligatio 4y ago

I don't recall anyone advocating omitting the name log4j when that security bug dropped in 2021. How is that situation materially different from this? redis-py fixed the behavior so it's definitely not the case of working-as-intended. To be clear, I would be up in arms if OpenAI was trying to hold redis potentially legally responsible.