3 ms·

They do authenticate it: it's disappointing how many people have 0 understanding of what happened and are commenting. OpenAI authenticates their API, and was g

They do authenticate it: it's disappointing how many people have 0 understanding of what happened and are commenting. OpenAI authenticates their API, and was getting paid for every query. OpenAI loses absolutely nothing from what these people were doing. Who was losing was random customers who have APIs and products that call up OpenAI. In some cases those customers even secured their API keys, but by the very nature of their product, you put in some input, and get some output from OpenAI. It's like if someone made a directory of apps that use Google's search API to show you results, so instead of paying for Google API access, you started slamming all of those apps with your queries. It's not cool to those apps, but Google shutting it down would be for the apps' benefit: they get paid either way.

bink 4y ago
Sounds like someone made a comprehensive directory of their customers who don't have properly secured APIs. Maybe instead of suing the creator of the directory they should use that list to contact their customers and have them secure their APIs?
- BoorishBears 4y ago
  Except they did secure their API. Take this implementation: https://github.com/xtekky/gpt4free/blob/main/gpt4free/italygpt/__init__.py https://github.com/xtekky/gpt4free/blob/main/gpt4free/italyg... The site has a rate limit, doesn't expose their API key, and it has a CSRF token. In terms of non-intrusive measures they could have taken, they did it all right. So what's left on the table is intrusive stuff: HN has a lot of people constantly whining about how they're stuck in captcha hell because their hand built Lenovo running Firefox on BSD compiled on an abacus isn't recognized as a real client... but aggressive captchas are going to become even more pervasive if every GPT based product must fight off proxy attempts.
  - pseg134 4y ago
    Yeah that’s what selenium browsers are for, they aren’t going to win this battle. They need to secure their endpoints .
    - BoorishBears 4y ago
      The endpoints are secured. I think you might want to pick up more context on what the library does and what the actual issue is.

bink 4y ago

Sounds like someone made a comprehensive directory of their customers who don't have properly secured APIs. Maybe instead of suing the creator of the directory they should use that list to contact their customers and have them secure their APIs?

BoorishBears 4y ago
Except they did secure their API. Take this implementation: https://github.com/xtekky/gpt4free/blob/main/gpt4free/italygpt/__init__.py https://github.com/xtekky/gpt4free/blob/main/gpt4free/italyg... The site has a rate limit, doesn't expose their API key, and it has a CSRF token. In terms of non-intrusive measures they could have taken, they did it all right. So what's left on the table is intrusive stuff: HN has a lot of people constantly whining about how they're stuck in captcha hell because their hand built Lenovo running Firefox on BSD compiled on an abacus isn't recognized as a real client... but aggressive captchas are going to become even more pervasive if every GPT based product must fight off proxy attempts.
- pseg134 4y ago
  Yeah that’s what selenium browsers are for, they aren’t going to win this battle. They need to secure their endpoints .
  - BoorishBears 4y ago
    The endpoints are secured. I think you might want to pick up more context on what the library does and what the actual issue is.