15 ms·

Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and ot

Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. A big reason we invest in this is because we want to keep free and logged-out access available for more users. My team’s goal is to help make sure the limited GPU resources are going to real users. We also keep a very close eye on the user impact. We monitor things like page load time, time to first token and payload size, with a focus on reducing the overhead of these protections. For the majority of people, the impact is negligible, and only a very small percentage may see a slight delay from extra checks. We also continuously evaluate precision so we can minimize false positives while still making abuse meaningfully harder.

crest 7mo ago
Then make sure they only target the free tier!
user3939382 7mo ago
Have you given any thought to what we trade when big tech elects one corporation as the gatekeeper for vast swaths of the Internet?
sebmellen 7mo ago
Great to hear from a first-party source. I'm a Pro subscriber and my team spends well over two thousand dollars per month on OpenAI subscriptions. However, even when I'm logged in with my Pro account, if I'm using a VPN provider like Mullvad, I often have trouble using the chat interface or I get timeout errors. Is this to be expected? I would presume that if I'm authenticated and paying, VPN use wouldn't be a worry. It would be nice to be able to use the tool whether or not I'm on a VPN.
- JumpCrisscross 7mo ago
  > even when I'm logged in with my Pro account, if I'm using a VPN provider like Mullvad, I often have trouble using the chat interface or I get timeout errors Heard from a founder who recently switched his company to Claude due to OpenAI's lagginess–it's absolutely an OpenAI problem. Not an AI problem in general.
mehov 7mo ago
> because we want to keep free and logged-out access But don't you run these checks on logged-in users too?
- MyNameIsNickT 7mo ago
  Yep, on logged-in users too. The reason is basically the same: we want scarce compute going to real people, not attackers. Being logged in is one useful signal, but it doesn’t fully prevent automation, account abuse, or other malicious traffic, so we apply protections in both cases.
  - angoragoats 7mo ago
    Nothing you do can fully prevent automation. Someone who wants to automate requests badly enough will be able to do it, especially when the “protections” are as easy to decrypt and analyze as the OP proved. Meanwhile, the rest of us (well, not me, because I don’t use your garbage product, but lots of others do) have to suffer and have our compute resources used up in the name of “protection.”
    - 3form 7mo ago
      Yeah, that's it. Also, it is a bit amusing to me - "We want to prevent automation", says the employee of Let's Automate Inc.
    - geetee 7mo ago
      [flagged]
  - salawat 7mo ago
    More like "We want your money, but don't want to provide service." Are you sure OpenAI isn't morphing into a finance/insurance company?
    - pixl97 7mo ago
      While OAI is one of the more hypocritical of the bunch, it is not uncommon for paid services to have some limitations in their terms of service. Like going in a store and buying stuff, it doesn't me a free for all doing whatever you want.
piskov 7mo ago
Tangential question: are there chatgpt app devs on X? There are a few from Codex team but I couldn’t find guys from “ordinary” chatgpt. Also if you could pass this over: it takes 5 taps to change thinking effort on ios and none (as in completely hidden) on macos. If I were to guess it seems that you were trying to lower the token usage :-). Why the effort is only nicely available on web and windows is beyond me
seba_dos1 7mo ago
Hi! It's all perfectly understandable - after all, we use things like Anubis to protect our services from OpenAI and similar actors and keep them available to the real users for exactly the same reasons.
andrepd 7mo ago
> OpenAI: These checks are part of how we protect products from abuse like bots, scraping, and other attempts to misuse the platform. This would be fucking HILARIOUS if it wasn't so tragic.
- Chance-Device 7mo ago
  It can be both
- rchaud 7mo ago
  Manifest destiny for me, border enforcement for thee.
  - lmz 7mo ago
    This kind of flawed thinking again. Like the natives didn't fight and lose wars against the manifest destiny types.
    - deleted 7mo ago
      [deleted]
    - ImPostingOnHN 7mo ago
      I don't think anybody claimed no Native Americans tried to fight back against their genocide?
      - lmz 7mo ago
        It's painting border enforcement as somehow immoral. There is no sin in trying to be better at it than those before.
        ImPostingOnHN 7mo ago
        genociding people to take their land within their borders is generally frowned upon today
c0_0p_ 7mo ago
Can't have those bots or scrapers running amok can we...
everdrive 7mo ago
It's getting to the point where a user needs at minimum two browsers. One to allow all this horrendous client checking so that crucial services work, and another browser to attempt to prevent tracking users across the web. Nick, I understand the practical realities regarding why you'd need to try to tamp down on some bot traffic, but do you see a world where users are not forced to choose between privacy and functionality?
- 0x3f 7mo ago
  Meet me in a cafe and I will sign a JWT saying you're not a bot. You can submit this to whoever will accept it.
  - jagged-chisel 7mo ago
    Sounds like we’re bringing back the PGP key signing parties
    - __MatrixMan__ 7mo ago
      The sooner we do the better.
      - hathawsh 7mo ago
        I wonder what the PGP signing concept does to thwart people who want to profit and don't care about the public good. It seems like anyone who attends a signing party can sell their key to the highest bidder, leading to bots and spammers all over again.
        0x3f 7mo ago
        You can never prevent things like this, but you can make it expensive enough to effectively solve the problem for almost all use cases.
        __MatrixMan__ 7mo ago
halflife 7mo ago
Don’t know if it’s related to the article, but the chats ui performance becomes absolutely horrendous in long chats. Typing the chat box is slow, rendering lags and sometimes gets stuck altogether. I have a research chat that I have to think twice before messaging because the performance is so bad. Running on iPhone 16 safari, and MacBook Pro m3 chrome.
- stacktraceyo 7mo ago
  Same. It’s wild how bad it can get with just like a normal longer running conversation
- moffkalast 7mo ago
  Yeah just had this earlier today, I had to write my response in vscode and paste it in, there were literal seconds of lag for typing each character. Typical bloated React.
  - scq 7mo ago
    Just because a web application uses React and is slow, it does not follow that it is slow because of React. It's perfectly possible to write fast or slow web applications in React, same as any other framework. Linear is one of the snappiest web applications I've ever used, and it is written in React.
    - brigandish 7mo ago
      Does not, in the seeming absence of other snappy examples and the overwhelming evidence of many, many slow React apps, the exception prove the rule?
      - scq 7mo ago
        There are plenty of snappy examples. Off the top of my head: Discord, Netflix, Signal Desktop, WhatsApp Web.
noosphr 7mo ago
>These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Can you share these mitigations so we can mitigate against you?
- 0x3f 7mo ago
  It's just Cloudflare. Bypassing it is a whole industry.
  - zenethian 7mo ago
    I read the comment as “use it to mitigate against OpenAI bots scraping the web” and not to mitigate Cloudflare.
    - 0x3f 7mo ago
      Well it's the same answer isn't it... use Cloudflare. And hope OpenAI doesn't have a backroom scraping deal with them, which they might.
- dawnerd 7mo ago
  Flaresolverr is one way. Isn’t perfect but bypasses a lot.
jgalt212 7mo ago
> we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform Have you just described the dilemma facing all the content sites used to train LLMs?
dev1ycan 7mo ago
"abuse like bots, scraping, fraud, and other attempts to misuse the platform" This has to be a joke, right?
- pera 7mo ago
  I really can't tell for sure (new user posting a ridiculously hypocritical corporate message on a Sunday) but if GP actually works for OpenAI the lack of self-awareness is seriously striking
  - singpolyma3 7mo ago
    How?
    - oblio 7mo ago
      Because OpenAI built their entire business around shamelessly scraping anything that had bits on it.
      - singpolyma3 7mo ago
        Maybe. But scraping isn't abuse. Seems a bit different?
        PunchyHamster 7mo ago
        Given that the scraping doesn't do any rate limiting and pisses on robots.txt, yes it is abuse
        singpolyma3 7mo ago
        Is there any evidence OpenAI has been ignoring robots.txt for scraping purposes? AFAIK the main sources of that traffic are still unknown.
        cycomanic 7mo ago
vkou 7mo ago
> Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. How can first-party products protect themselves from abuse by OpenAI's bots and scraping?
- mystraline 7mo ago
  This is a completely in-scope question. How do we defend against your scraping, OpenAI? I dont want any of my content scraped or seen by you all. Frankly, fuck you all for thinking my content is owned by you.
  - wilg 7mo ago
    robots.txt bro https://developers.openai.com/api/docs/bots/ https://developers.openai.com/api/docs/bots/
    - tomalbrc 7mo ago
      "bro": https://www.businessinsider.com/openai-anthropic-ai-ignore-rule-scraping-web-contect-robotstxt?op=1 https://www.businessinsider.com/openai-anthropic-ai-ignore-r...
      - wilg 7mo ago
        should be pretty easy to test and not rely on an anonymous source from a weird analytics company via business insider. are these bots actually from openai or are they just using their user agent? are they coming from openai ip ranges? etc. https://openai.com/gptbot.json https://openai.com/gptbot.json
        ImPostingOnHN 7mo ago
        > should be pretty easy to test I look forward to your results, whether or not they disprove the article.
quotemstr 7mo ago
We really need ZKPs of humanity
- ctoth 7mo ago
  No, we really don't. We don't need worldcoin, we don't need papers, please. We just don't. "Prove your humanity/age/other properties" with this mechanism quickly goes places you do not want it to go.
  - quotemstr 7mo ago
    No, it doesn't go places we "do not want it to go". What part of zero knowledge doesn't make sense? How precisely does a free, unlinkable, multi-vendor, open-source cryptographic attestation of recent humanity create something terrible? It would behoove people to engage with the substance of attestation proposals. It's lazy to state that any verification scheme whatsoever is equivalent to a panopticon, dystopia as thought-terminating cliche. We really do have the technology now to attest biographical details in such a way that whoever attests to a fact about you can't learn the use to which you put that attestation and in such a way that the person who verifies your attestation can see it's genuine without learning anything about you except that one bit of information you disclose. And no, such a ZK scheme does not turn instantly into some megacorp extracting monopoly rents from some kind of internet participation toll booth. Why would this outcome be inevitable? We have plenty of examples of fair and open ecosystems. It's just lazy to assert right out of the gate that any attestation scheme is going to be captured. So, please, can we stop matching every scheme whatsoever for verifying facts as actors as the East German villain in a cold war movie? We're talking about something totally different.
    - ctoth 7mo ago
      The ZK part isn't the problem. The "attestation of recent humanity" part is. Who attests? What happens when someone can't get attested? You've been to the doctor recently, right? Given them your SSN? Every identity system ever built was going to be scoped || voluntary. None of them stayed that way. Once you have the identity mechanism, "Oh it's zero knowledge! So let's use it for your age! Have you ever been convicted?" which leads to "mandated by employers" which leads to... We've seen this goddamn movie before. Let's just skip it this time? Please?
deleted 7mo ago
[deleted]
myHNAccount123 7mo ago
Can you fix the resizing text box issue on Safari when a new line is inserted? When your question wraps to a newline Safari locks up for a few seconds and it's really annoying. You can test by pasting text too.
the_gipsy 7mo ago
But is the title true, is typing specifically blocked? Or does it just block submitting the text? I ask because I have seen huge variations in load time. Sometimes I had to wait seconds until being able to type. Nowadays it seems better though.
huertouisj 7mo ago
sometimes I paste giant texts (think summarization) in the chatgpt (paid) webapp and I noticed that the CPU fans spin up for about 5 seconds after, as if the text is "processed" client side somehow. this is before hitting "submit" to send the prompt to the model. I assumed it was maybe some tokenization going on client side, but now I realize maybe it's some proof of work related to prompt length?
rglullis 7mo ago
I shouldn't be giving ideas to your boss, but I bet he would be interested in making ChatGPT available only by paying customers or free for those whose who gets their eyes scanned by The Orb. Give 30 days of raised limits and we're all set to live in the dystopia he wants.
thegreatpeter 7mo ago
You’re doing gods work sir, thank you!
pdntspa 7mo ago
Y'all just salty that DeepSeek et al are training their LLMs on yours
nickphx 7mo ago
the irony of your statement is hilarious, disappointing, and infuriating.
Imnimo 7mo ago
It's interesting to me that OpenAI considers scraping to be a form of abuse.
- sabedevops 7mo ago
  Seriously. The hypocrisy is staggering!
- zer00eyz 7mo ago
  " Integrity at OpenAI .. protect ... abuse like bots, scraping, fraud " Did you mean to use the word hypocrisy. If not, I'm happy to have said it. I just want to note, that it is well covered how good the support is for actual malware...
- ProofHouse 7mo ago
  The irony is thick
- nikitaga 7mo ago
  Scraping static content from a website at near-zero marginal cost to its server, vs scraping an expensive LLM service provided for free, are different things. The former relies on fairly controversial ideas about copyright and fair use to qualify as abuse, whereas the latter is direct financial damage – by your own direct competitors no less. It's fun to poke at a seeming hypocrisy of the big bad, but the similarity in this case is quite superficial.
  - AtlasBarfed 7mo ago
    Because you say it is? I obviously disagree. I mean, on top of this we are talking about not-open OpenAI.
  - bakugo 7mo ago
    The cost is so marginal that many, many websites have been forced to add cloudflare captchas or PoW checks before letting anyone access them, because the server would slow to a crawl from 1000 scrapers hitting it at once otherwise.
  - 7mo ago
0dayman 7mo ago
Hi Nick, your software is a horrendous encroachment on users' privacy and its quality is subpar to those of us who know what we're working with. We don't use your product here.
- chronc6393 7mo ago
  > Hi Nick, your software is a horrendous encroachment on users' privacy and its quality is subpar to those of us who know what we're working with. We don't use your product here. It’s ok, OpenAI is cooked. Feel bad for anyone who joined OAI in the past 12 months. Their RSU ain’t going to be worth much later this year. IPO is too late.
JumpCrisscross 7mo ago
> we want to keep free and logged-out access available for more users How does this comport with OpenAI's new B2B-first strategy? > We also keep a very close eye on the user impact Are paid or logged-in users also penalised?
huflungdung 7mo ago
[dead]
driverdan 7mo ago
Brand new account with 2 comments in this thread. How can we be sure you're not a bot deployed to defend OpenAI? Please run Cloudflare's privacy invasive tool and share all the values it generates here so we can determine if you're a real person.
tomalbrc 7mo ago
Fake Account
tipiirai 7mo ago
I don't trust what OpenAI says. Sam Altman gives shivers, and these kinds of blog posts make things look even worse.
subscribed 7mo ago
> "abuse like bots, scraping" You what, mate? Would you please use that on yourselves first? Because it comes off as a GROSS hypocrisy. State of the art hypocrisy. >> behavioral biometric layer But this one, especially, takes the cake. Quite disgusting.
lm411 7mo ago
"we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform" The scary part is that you don't even see the irony in writing this. Or, are you just okay "misusing" everyone for your own benefit?
vlovich123 7mo ago
That still doesn’t explain why you can’t even start typing until that check proceeds. You could condition the outbound request from being processed until that’s the case. But preventing from typing seems like it’s just worse UX and the problem will fail to appear in any metrics you can track because you have no way of measuring “how quickly would the user have submitted their request without all this other stuff in the way”. Said another way, if done in the background the user wouldn’t even notice unless they typed and submitted their query before the check completed. In the realistic scenario this would complete before they even submit their request.
- p-e-w 7mo ago
  Many cloud products now continuously send themselves the input you type while you are typing it, to squeeze the maximum possible amount of data from your interactions. I don’t know whether ChatGPT is one of those products, but if it is, that behavior might be a side effect of blocking the input pipeline until verification completes. It might be that they want to get every single one of your keystrokes, but only after checking that you’re not a bot.
  - davidkunz 7mo ago
    It's still possible to let users already type from the beginning, just delay sending the characters until checks are complete. Hold them in memory until then.
    - miyuru 7mo ago
      Instagram was uploading the images while the user were adding post details, back in 2012! https://news.ycombinator.com/item?id=3913919 https://news.ycombinator.com/item?id=3913919 No one seem to use or care about their own product anymore. Only uses dashboard and metrics, which does not explain the full situation.
      - AlecSchueler 7mo ago
        That makes total sense from a UX perspective though, the ChatGPT thing does not.
kelnos 7mo ago
> A big reason we invest in this is because we want to keep free and logged-out access available for more users. Are these checks disabled for logged-in, paid users?
freeopinion 7mo ago
Its your business and your call. But my opinion is that I wish you would quit offering free services. I'm pretty concerned about the horrible effect your free services are having on education. Yes, AI can be an incredible tool to enhance education. But the reality is that it is decimating children's will to learn anything. I don't want to blame AI for all the world's problems. And I don't want to throw the baby out with the bath water. But I think you should think really hard about the value of gates. Smart people can build better gates than cash. But right now, cash might be better than nothing. Clearly you have already thought about how to build gates, but I don't think you have spent enough time thinking about who should be gated and why. You should think about gates that have more purpose than just maximizing your profit. "We want to hook as many people as possible without letting in our competitors" is a pretty crummy thought to use as a public justification. (Edited for typos.)
gck1 7mo ago
I always wondered why you even have logged out access. I'm glad I can use ChatGPT in incognito when I want a "clean room" response, but surely that's not the primary use case. Is user base that never logs in really that significant?
- pocksuppet 7mo ago
  This episode proves they know who you are, even when you're logged out. If they didn't know, they wouldn't let you use the service.
lm411 7mo ago
"Integrity at OpenAI" Basically an oxymoron at this point.
potsandpans 7mo ago
Chatgpt banned me after I said disparaging things about Sam Altman in a chat. When I appealed the ban, I was told that I couldn't be told exactly why I was banned, but if I wrote a written apology and "promised to never do it again" my ban could be appealed. I asked for an update on the ban via email every month for over a year. Maybe you could tell me a little bit about that process?
Razengan 7mo ago
> we want to keep free and logged-out access available for more users. And THANK YOU for that! Being able to use ChatGPT and Grok without signing in is a big part of why I like those services over Gemini etc. Hell, dummy Claude won't even let me Sign-In-with-Apple on the Mac desktop, even though it let me Sign-UP-with-Apple on the iPhone! BUT they do support Sign-In-with-Google!!? What in the heavenly hell is this dumbassery
SubiculumCode 7mo ago
In long threads in chatgpt, it grinds to a halt in both Chrome and Firefox. Please fix
gmerc 7mo ago
the company that scrapes every until it collapses really needs to protect itself from scraping. Lol.
tekawade 7mo ago
Hey Nick, I find it concerning this account is. Frayed just to comment on this thread. And never even reply back to any of the real concerns. Here to hoping this is real person and actually created account out of concern and sharing.
egorfine 7mo ago
Paying customer since inception here. I presume the local ChatGPT.app has even more measures to prevent automation, right? Presumably privacy-invasive ones as it is customary these days? Is there a way I can opt out? I really, really, really don't like it.
- radicality 7mo ago
  The way I use the products something like this. My main account on my MacBook - ChatGPT website, codex cli. Then, a Mac VM running via UTM with shared writable dir - anything more ‘shady’ in terms of permissions and for playing with new ai apps - eg ChatGPT/Codex standalone apps, Atlas, Claude desktop app etc. Seems to work decently enough. And I do totally agree that there should be a way to opt out of all these privacy invasive measures, especially after paying $200/mo
lionkor 7mo ago
Hi Nick, first of all, very cool of you to respond here instead of letting us all sit in the dark. I think that's what makes HN special. That said, is it not a little bit weird that you want to protect yourself from scraping and bots, when your entire company, product, revenue, and your employment, depends on the fact that OpenAI can bot and scrape literally every part of the internet? So your moat is non-hydrated react code in the frontend?
- Schiendelman 7mo ago
  Don't beat up an engineer for decisions made by company leadership. It's really inappropriate.
  - diebillionaires 7mo ago
    Yeah, no one is responsible for what they do as long as someone else tells them to do it.
  - lionkor 7mo ago
    They decided to work at this company, I think it's a reasonable discussion to have?
  - SilasX 7mo ago
    While I would generally sympathize on that front, it doesn't really apply here. None of the management-level desiderata he appealed to require that the user experience be broken this bad. There is very little bot deterrence from prevention of typing at that stage, while it heavily impacts user experience, especially on mobile. I elaborate here: https://news.ycombinator.com/item?id=47575982 https://news.ycombinator.com/item?id=47575982
witx 7mo ago
> These checks are part of how we protect our first-party products from abuse like bots, scraping, Do you guys see the irony here?
- hosteur 7mo ago
  They obviously get it. They just do not care.
nicbou 7mo ago
For what it's worth, I switched to Gemini because of the long ChatGPT load time. Gemini loads as fast as Google Search.
numlock86 7mo ago
> [...] we protect our first-party products from abuse like [...] scraping [...] what an odd thing to say for someone whose product is built entirely on exactly that
invalidusernam3 7mo ago
But why block the ui until then? Surely you can just not make any requests until the checks are complete?
prmoustache 7mo ago
> we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Isn't that how you build your service from the very start? How ironic.
wiseowise 7mo ago
> A big reason we invest in this is because we want to keep free and logged-out access available for more users. Thank you for the reply, Nick. It wouldn’t be a problem to disable the tracking for authenticated users then, would it?
- lloydatkinson 7mo ago
  It would because someone's KPI depends on number of tracked users lol
  - matsemann 7mo ago
    If logging in disabled all checks, all bots would just spam-create users first. Of course it needs to run for all users, without it being necessarily nefarious.
    - toddmorey 7mo ago
      Paid users?
owebmaster 7mo ago
The reason why you did it is clear, why you guys settle down for such a poor implementation is why this thread exists
conartist6 7mo ago
Still feels very anti-consumer. If every company behaved like you do, the internet would be a much worse place. In fact, OpenAI has already made the Internet a much worse place, already much, much less open and much less optimistic about its own future than it was even five years ago...
deleted 7mo ago
[deleted]
aucisson_masque 7mo ago
Why send the Turnstile bytecode encrypted ? Surely people savvy enough to abuse the system will find out how to decrypt it, see OP, and it gives the impression that you are trying to hide stuffs you're not proud about.
- pocksuppet 7mo ago
  Because they want to make it as hard as possible to reverse engineer. If they wanted it to be easy, they'd use <input type="checkbox" name="ishuman">I am a human
marxisttemp 7mo ago
History will not be kind to you and your ilk. Quit your job.
sourcecodeplz 7mo ago
I really appreciate the free options, without even needing a login. Wish they would also keep the small free weekly allowance for Codex.
xtajv 7mo ago
Earnest question: if I was feeling lazy and security-conscious at the same time, would I be better off... (A) opening chatgpt.com in qubes (but staying logged out, i.e. never creating a chatgpt account) -or- (B) creating a freemium chatgpt account ? (Obviously, the "best" answer would be something like running a local LLM from an airgapped machine in a concrete bunker :) But that's not what I'm after).
20k 7mo ago
>abuse like bots, scraping 10/10, I've got no notes
boesboes 7mo ago
lol, hypocrites.
MisterTea 7mo ago
> These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Isn't this the same behavior used by AI companies to gather training data? Pot, meet kettle.
cheese_van 7mo ago
<protect our first-party products from abuse like scraping> Abuse from scraping has long been a serious problem for many, good job!
ryanmcbride 7mo ago
Protecting your site from bots and scraping is absolutely hilarious considering how you acquired (read: stole) the data you trained your bot on dude. Just yank that ladder up behind you.
- pocksuppet 7mo ago
  > Just yank that ladder up behind you. You would be an irresponsible entrepreneur if you didn't. Don't forget your legal obligation to maximise shareholder value.
blactuary 7mo ago
> I work on Integrity at OpenAI Irony is truly dead. Show you have integrity by quitting your job
mghackerlady 7mo ago
No, leave it. Surely the mighty OpenAI can deal with the scraping. At least, it seems to think everyone else can
leros 7mo ago
Fwiw, I stopped using ChatGPT and went to a competitor because the checks slow down ChatGPT so much that the webapp becomes unusable in anything but a new short chat. CPU usage goes to 100%, you can't type, the entire tab freezes, etc. It's a miserable experience to use and I'm on a relatively new MacBook not some old computer. If you read around it's a very common problem people have been having for a while now.
toddmorey 7mo ago
Why are all these checks still performed on an authenticated, paid user?
diebillionaires 7mo ago
As a free tier user I only get like three queries in now without model quality reduction, so I'd say your bases are covered as far as GPU costs around misuse.
lifis 7mo ago
Are you disabling them for paying subscribers?
throwaway613746 7mo ago
[dead]
matheusmoreira 7mo ago
> protect our first-party products from abuse like bots, scraping You do see the irony here?
ghm2199 7mo ago
Would OpenAI also consider renumerations to every site they have scraped that had a robots.txt file and they chose to ignore it anyway? Feel free to not answer this question. I have kind of lost count of how many content creators have said personally to me traffic is meaningfully down because of all these chatbots. The latest example is this poor but standup guy: moneyfortherestofus.com.
- timeinput 7mo ago
  I'm really glad Hacker News disallows AI generated comments. The response I got from asking that question really is quite enlightening. Short answer: "no", long answer: "no -- fuck off", longer answer: "no -- fuck off -- if you want I can dig into whether or not you should fuck off harder"
wackget 7mo ago
I understand it's not your area, but can you please politely tell your colleagues that the clickbait-type teaser questions from the latest model are absolutely infuriating and are quickly leading to me abandon the platform entirely? If you'd like, I can write a two-sentence paragraph to send to your colleagues. It contains a special phrase which most colleagues will find difficult to ignore. Would you like me to do that?
htx80nerd 7mo ago
Thanks. I've used ChatGPT a million times and never had any input issues.
rsrsrs86 7mo ago
Hi Nick, do you believe what you say? You scraped the shit out of everyone
SilasX 7mo ago
It has not been negligible for me, and, however you're doing this, there is significant room for improvement. There have been times when, across about ten minutes of usage, most of which is me typing on iOS Safari, it drained 15% of my battery. There is no functional justification for this beyond poor code quality. (It was on a long conversation FWIW.) This when I'm logged in, with a paid (Plus) account, connected to a very old email address with a real user profile. That can't be the result of super-clever bot defense measures, because it's merely an inconvenience on desktop. And if you genuinely believe that email has been compromised, why aren't you reaching out the to the account owner, as the account isn't otherwise connected to fraud by your heuristics? However brilliant the LLM agent it is, I'm seeing a lot of unforced errors regarding how you implement a web interface to it. If it makes you feel any better, it doesn't really register compared to all the bloat I see on other sites.
sandeepkd 7mo ago
You do not ever trust the client side. Sometimes being simple is good enough. The maximum you can do is put rate limits on the IP address and/or user account. You just do not want some one to use the product at machine speeds.
tempaccountabgd 7mo ago
[dead]
xg15 7mo ago
> how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Are you applying the same standards to your own scraper bots?
AndrewKemendo 7mo ago
Kudos for trying This whole thread was like watching a swarm of ants try and take a grasshopper down
jesuslop 7mo ago
Hi Nick, the lag is quite bad in the field, honest. In desktop app in this case/datapoint. There was that "halt and catch fire" episode where they spoke about a millisencod threshold of delay that separated usability and non. Solvent hw and fiber connection.
opsdu 7mo ago
[dead]
account42 7mo ago
> These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. The lack of self awareness...
arendtio 7mo ago
Do you do those checks only for users without accounts or also for those with accounts?

crest 7mo ago

Then make sure they only target the free tier!

user3939382 7mo ago

Have you given any thought to what we trade when big tech elects one corporation as the gatekeeper for vast swaths of the Internet?

sebmellen 7mo ago

Great to hear from a first-party source. I'm a Pro subscriber and my team spends well over two thousand dollars per month on OpenAI subscriptions. However, even when I'm logged in with my Pro account, if I'm using a VPN provider like Mullvad, I often have trouble using the chat interface or I get timeout errors. Is this to be expected? I would presume that if I'm authenticated and paying, VPN use wouldn't be a worry. It would be nice to be able to use the tool whether or not I'm on a VPN.

JumpCrisscross 7mo ago
> even when I'm logged in with my Pro account, if I'm using a VPN provider like Mullvad, I often have trouble using the chat interface or I get timeout errors Heard from a founder who recently switched his company to Claude due to OpenAI's lagginess–it's absolutely an OpenAI problem. Not an AI problem in general.

mehov 7mo ago

> because we want to keep free and logged-out access But don't you run these checks on logged-in users too?

MyNameIsNickT 7mo ago
Yep, on logged-in users too. The reason is basically the same: we want scarce compute going to real people, not attackers. Being logged in is one useful signal, but it doesn’t fully prevent automation, account abuse, or other malicious traffic, so we apply protections in both cases.
- angoragoats 7mo ago
  Nothing you do can fully prevent automation. Someone who wants to automate requests badly enough will be able to do it, especially when the “protections” are as easy to decrypt and analyze as the OP proved. Meanwhile, the rest of us (well, not me, because I don’t use your garbage product, but lots of others do) have to suffer and have our compute resources used up in the name of “protection.”
  - 3form 7mo ago
    Yeah, that's it. Also, it is a bit amusing to me - "We want to prevent automation", says the employee of Let's Automate Inc.
  - geetee 7mo ago
    [flagged]
- salawat 7mo ago
  More like "We want your money, but don't want to provide service." Are you sure OpenAI isn't morphing into a finance/insurance company?
  - pixl97 7mo ago
    While OAI is one of the more hypocritical of the bunch, it is not uncommon for paid services to have some limitations in their terms of service. Like going in a store and buying stuff, it doesn't me a free for all doing whatever you want.

piskov 7mo ago

Tangential question: are there chatgpt app devs on X? There are a few from Codex team but I couldn’t find guys from “ordinary” chatgpt. Also if you could pass this over: it takes 5 taps to change thinking effort on ios and none (as in completely hidden) on macos. If I were to guess it seems that you were trying to lower the token usage :-). Why the effort is only nicely available on web and windows is beyond me

seba_dos1 7mo ago

Hi! It's all perfectly understandable - after all, we use things like Anubis to protect our services from OpenAI and similar actors and keep them available to the real users for exactly the same reasons.

andrepd 7mo ago

> OpenAI: These checks are part of how we protect products from abuse like bots, scraping, and other attempts to misuse the platform. This would be fucking HILARIOUS if it wasn't so tragic.

Chance-Device 7mo ago
It can be both
rchaud 7mo ago
Manifest destiny for me, border enforcement for thee.
- lmz 7mo ago
  This kind of flawed thinking again. Like the natives didn't fight and lose wars against the manifest destiny types.
  - deleted 7mo ago
    [deleted]
  - ImPostingOnHN 7mo ago
    I don't think anybody claimed no Native Americans tried to fight back against their genocide?
    - lmz 7mo ago
      It's painting border enforcement as somehow immoral. There is no sin in trying to be better at it than those before.
      - ImPostingOnHN 7mo ago
        genociding people to take their land within their borders is generally frowned upon today

c0_0p_ 7mo ago

Can't have those bots or scrapers running amok can we...

everdrive 7mo ago

It's getting to the point where a user needs at minimum two browsers. One to allow all this horrendous client checking so that crucial services work, and another browser to attempt to prevent tracking users across the web. Nick, I understand the practical realities regarding why you'd need to try to tamp down on some bot traffic, but do you see a world where users are not forced to choose between privacy and functionality?

0x3f 7mo ago
Meet me in a cafe and I will sign a JWT saying you're not a bot. You can submit this to whoever will accept it.
- jagged-chisel 7mo ago
  Sounds like we’re bringing back the PGP key signing parties
  - __MatrixMan__ 7mo ago
    The sooner we do the better.
    - hathawsh 7mo ago
      I wonder what the PGP signing concept does to thwart people who want to profit and don't care about the public good. It seems like anyone who attends a signing party can sell their key to the highest bidder, leading to bots and spammers all over again.
      - 0x3f 7mo ago
        You can never prevent things like this, but you can make it expensive enough to effectively solve the problem for almost all use cases.
      - __MatrixMan__ 7mo ago

halflife 7mo ago

Don’t know if it’s related to the article, but the chats ui performance becomes absolutely horrendous in long chats. Typing the chat box is slow, rendering lags and sometimes gets stuck altogether. I have a research chat that I have to think twice before messaging because the performance is so bad. Running on iPhone 16 safari, and MacBook Pro m3 chrome.

stacktraceyo 7mo ago
Same. It’s wild how bad it can get with just like a normal longer running conversation
moffkalast 7mo ago
Yeah just had this earlier today, I had to write my response in vscode and paste it in, there were literal seconds of lag for typing each character. Typical bloated React.
- scq 7mo ago
  Just because a web application uses React and is slow, it does not follow that it is slow because of React. It's perfectly possible to write fast or slow web applications in React, same as any other framework. Linear is one of the snappiest web applications I've ever used, and it is written in React.
  - brigandish 7mo ago
    Does not, in the seeming absence of other snappy examples and the overwhelming evidence of many, many slow React apps, the exception prove the rule?
    - scq 7mo ago
      There are plenty of snappy examples. Off the top of my head: Discord, Netflix, Signal Desktop, WhatsApp Web.

noosphr 7mo ago

>These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Can you share these mitigations so we can mitigate against you?

0x3f 7mo ago
It's just Cloudflare. Bypassing it is a whole industry.
- zenethian 7mo ago
  I read the comment as “use it to mitigate against OpenAI bots scraping the web” and not to mitigate Cloudflare.
  - 0x3f 7mo ago
    Well it's the same answer isn't it... use Cloudflare. And hope OpenAI doesn't have a backroom scraping deal with them, which they might.
dawnerd 7mo ago
Flaresolverr is one way. Isn’t perfect but bypasses a lot.

jgalt212 7mo ago

> we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform Have you just described the dilemma facing all the content sites used to train LLMs?

dev1ycan 7mo ago

"abuse like bots, scraping, fraud, and other attempts to misuse the platform" This has to be a joke, right?

pera 7mo ago
I really can't tell for sure (new user posting a ridiculously hypocritical corporate message on a Sunday) but if GP actually works for OpenAI the lack of self-awareness is seriously striking
- singpolyma3 7mo ago
  How?
  - oblio 7mo ago
    Because OpenAI built their entire business around shamelessly scraping anything that had bits on it.
    - singpolyma3 7mo ago
      Maybe. But scraping isn't abuse. Seems a bit different?
      - PunchyHamster 7mo ago
        Given that the scraping doesn't do any rate limiting and pisses on robots.txt, yes it is abuse
        singpolyma3 7mo ago
        Is there any evidence OpenAI has been ignoring robots.txt for scraping purposes? AFAIK the main sources of that traffic are still unknown.
      - cycomanic 7mo ago

vkou 7mo ago

> Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. How can first-party products protect themselves from abuse by OpenAI's bots and scraping?

mystraline 7mo ago
This is a completely in-scope question. How do we defend against your scraping, OpenAI? I dont want any of my content scraped or seen by you all. Frankly, fuck you all for thinking my content is owned by you.
- wilg 7mo ago
  robots.txt bro https://developers.openai.com/api/docs/bots/ https://developers.openai.com/api/docs/bots/
  - tomalbrc 7mo ago
    "bro": https://www.businessinsider.com/openai-anthropic-ai-ignore-rule-scraping-web-contect-robotstxt?op=1 https://www.businessinsider.com/openai-anthropic-ai-ignore-r...
    - wilg 7mo ago
      should be pretty easy to test and not rely on an anonymous source from a weird analytics company via business insider. are these bots actually from openai or are they just using their user agent? are they coming from openai ip ranges? etc. https://openai.com/gptbot.json https://openai.com/gptbot.json
      - ImPostingOnHN 7mo ago
        > should be pretty easy to test I look forward to your results, whether or not they disprove the article.

quotemstr 7mo ago

We really need ZKPs of humanity

ctoth 7mo ago
No, we really don't. We don't need worldcoin, we don't need papers, please. We just don't. "Prove your humanity/age/other properties" with this mechanism quickly goes places you do not want it to go.
- quotemstr 7mo ago
  No, it doesn't go places we "do not want it to go". What part of zero knowledge doesn't make sense? How precisely does a free, unlinkable, multi-vendor, open-source cryptographic attestation of recent humanity create something terrible? It would behoove people to engage with the substance of attestation proposals. It's lazy to state that any verification scheme whatsoever is equivalent to a panopticon, dystopia as thought-terminating cliche. We really do have the technology now to attest biographical details in such a way that whoever attests to a fact about you can't learn the use to which you put that attestation and in such a way that the person who verifies your attestation can see it's genuine without learning anything about you except that one bit of information you disclose. And no, such a ZK scheme does not turn instantly into some megacorp extracting monopoly rents from some kind of internet participation toll booth. Why would this outcome be inevitable? We have plenty of examples of fair and open ecosystems. It's just lazy to assert right out of the gate that any attestation scheme is going to be captured. So, please, can we stop matching every scheme whatsoever for verifying facts as actors as the East German villain in a cold war movie? We're talking about something totally different.
  - ctoth 7mo ago
    The ZK part isn't the problem. The "attestation of recent humanity" part is. Who attests? What happens when someone can't get attested? You've been to the doctor recently, right? Given them your SSN? Every identity system ever built was going to be scoped || voluntary. None of them stayed that way. Once you have the identity mechanism, "Oh it's zero knowledge! So let's use it for your age! Have you ever been convicted?" which leads to "mandated by employers" which leads to... We've seen this goddamn movie before. Let's just skip it this time? Please?

deleted 7mo ago

[deleted]

myHNAccount123 7mo ago

Can you fix the resizing text box issue on Safari when a new line is inserted? When your question wraps to a newline Safari locks up for a few seconds and it's really annoying. You can test by pasting text too.

the_gipsy 7mo ago

But is the title true, is typing specifically blocked? Or does it just block submitting the text? I ask because I have seen huge variations in load time. Sometimes I had to wait seconds until being able to type. Nowadays it seems better though.

huertouisj 7mo ago

sometimes I paste giant texts (think summarization) in the chatgpt (paid) webapp and I noticed that the CPU fans spin up for about 5 seconds after, as if the text is "processed" client side somehow. this is before hitting "submit" to send the prompt to the model. I assumed it was maybe some tokenization going on client side, but now I realize maybe it's some proof of work related to prompt length?

rglullis 7mo ago

I shouldn't be giving ideas to your boss, but I bet he would be interested in making ChatGPT available only by paying customers or free for those whose who gets their eyes scanned by The Orb. Give 30 days of raised limits and we're all set to live in the dystopia he wants.

thegreatpeter 7mo ago

You’re doing gods work sir, thank you!

pdntspa 7mo ago

Y'all just salty that DeepSeek et al are training their LLMs on yours

nickphx 7mo ago

the irony of your statement is hilarious, disappointing, and infuriating.

Imnimo 7mo ago

It's interesting to me that OpenAI considers scraping to be a form of abuse.

sabedevops 7mo ago
Seriously. The hypocrisy is staggering!
zer00eyz 7mo ago
" Integrity at OpenAI .. protect ... abuse like bots, scraping, fraud " Did you mean to use the word hypocrisy. If not, I'm happy to have said it. I just want to note, that it is well covered how good the support is for actual malware...
ProofHouse 7mo ago
The irony is thick
nikitaga 7mo ago
Scraping static content from a website at near-zero marginal cost to its server, vs scraping an expensive LLM service provided for free, are different things. The former relies on fairly controversial ideas about copyright and fair use to qualify as abuse, whereas the latter is direct financial damage – by your own direct competitors no less. It's fun to poke at a seeming hypocrisy of the big bad, but the similarity in this case is quite superficial.
- AtlasBarfed 7mo ago
  Because you say it is? I obviously disagree. I mean, on top of this we are talking about not-open OpenAI.
- bakugo 7mo ago
  The cost is so marginal that many, many websites have been forced to add cloudflare captchas or PoW checks before letting anyone access them, because the server would slow to a crawl from 1000 scrapers hitting it at once otherwise.
- 7mo ago

0dayman 7mo ago

Hi Nick, your software is a horrendous encroachment on users' privacy and its quality is subpar to those of us who know what we're working with. We don't use your product here.

chronc6393 7mo ago
> Hi Nick, your software is a horrendous encroachment on users' privacy and its quality is subpar to those of us who know what we're working with. We don't use your product here. It’s ok, OpenAI is cooked. Feel bad for anyone who joined OAI in the past 12 months. Their RSU ain’t going to be worth much later this year. IPO is too late.

JumpCrisscross 7mo ago

> we want to keep free and logged-out access available for more users How does this comport with OpenAI's new B2B-first strategy? > We also keep a very close eye on the user impact Are paid or logged-in users also penalised?

huflungdung 7mo ago

[dead]

driverdan 7mo ago

Brand new account with 2 comments in this thread. How can we be sure you're not a bot deployed to defend OpenAI? Please run Cloudflare's privacy invasive tool and share all the values it generates here so we can determine if you're a real person.

tomalbrc 7mo ago

Fake Account

tipiirai 7mo ago

I don't trust what OpenAI says. Sam Altman gives shivers, and these kinds of blog posts make things look even worse.

subscribed 7mo ago

> "abuse like bots, scraping" You what, mate? Would you please use that on yourselves first? Because it comes off as a GROSS hypocrisy. State of the art hypocrisy. >> behavioral biometric layer But this one, especially, takes the cake. Quite disgusting.

lm411 7mo ago

"we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform" The scary part is that you don't even see the irony in writing this. Or, are you just okay "misusing" everyone for your own benefit?

vlovich123 7mo ago

That still doesn’t explain why you can’t even start typing until that check proceeds. You could condition the outbound request from being processed until that’s the case. But preventing from typing seems like it’s just worse UX and the problem will fail to appear in any metrics you can track because you have no way of measuring “how quickly would the user have submitted their request without all this other stuff in the way”. Said another way, if done in the background the user wouldn’t even notice unless they typed and submitted their query before the check completed. In the realistic scenario this would complete before they even submit their request.

p-e-w 7mo ago
Many cloud products now continuously send themselves the input you type while you are typing it, to squeeze the maximum possible amount of data from your interactions. I don’t know whether ChatGPT is one of those products, but if it is, that behavior might be a side effect of blocking the input pipeline until verification completes. It might be that they want to get every single one of your keystrokes, but only after checking that you’re not a bot.
- davidkunz 7mo ago
  It's still possible to let users already type from the beginning, just delay sending the characters until checks are complete. Hold them in memory until then.
  - miyuru 7mo ago
    Instagram was uploading the images while the user were adding post details, back in 2012! https://news.ycombinator.com/item?id=3913919 https://news.ycombinator.com/item?id=3913919 No one seem to use or care about their own product anymore. Only uses dashboard and metrics, which does not explain the full situation.
    - AlecSchueler 7mo ago
      That makes total sense from a UX perspective though, the ChatGPT thing does not.

kelnos 7mo ago

> A big reason we invest in this is because we want to keep free and logged-out access available for more users. Are these checks disabled for logged-in, paid users?

freeopinion 7mo ago

Its your business and your call. But my opinion is that I wish you would quit offering free services. I'm pretty concerned about the horrible effect your free services are having on education. Yes, AI can be an incredible tool to enhance education. But the reality is that it is decimating children's will to learn anything. I don't want to blame AI for all the world's problems. And I don't want to throw the baby out with the bath water. But I think you should think really hard about the value of gates. Smart people can build better gates than cash. But right now, cash might be better than nothing. Clearly you have already thought about how to build gates, but I don't think you have spent enough time thinking about who should be gated and why. You should think about gates that have more purpose than just maximizing your profit. "We want to hook as many people as possible without letting in our competitors" is a pretty crummy thought to use as a public justification. (Edited for typos.)

gck1 7mo ago

I always wondered why you even have logged out access. I'm glad I can use ChatGPT in incognito when I want a "clean room" response, but surely that's not the primary use case. Is user base that never logs in really that significant?

pocksuppet 7mo ago
This episode proves they know who you are, even when you're logged out. If they didn't know, they wouldn't let you use the service.

lm411 7mo ago

"Integrity at OpenAI" Basically an oxymoron at this point.

potsandpans 7mo ago

Chatgpt banned me after I said disparaging things about Sam Altman in a chat. When I appealed the ban, I was told that I couldn't be told exactly why I was banned, but if I wrote a written apology and "promised to never do it again" my ban could be appealed. I asked for an update on the ban via email every month for over a year. Maybe you could tell me a little bit about that process?

Razengan 7mo ago

> we want to keep free and logged-out access available for more users. And THANK YOU for that! Being able to use ChatGPT and Grok without signing in is a big part of why I like those services over Gemini etc. Hell, dummy Claude won't even let me Sign-In-with-Apple on the Mac desktop, even though it let me Sign-UP-with-Apple on the iPhone! BUT they do support Sign-In-with-Google!!? What in the heavenly hell is this dumbassery

SubiculumCode 7mo ago

In long threads in chatgpt, it grinds to a halt in both Chrome and Firefox. Please fix

gmerc 7mo ago

the company that scrapes every until it collapses really needs to protect itself from scraping. Lol.

tekawade 7mo ago

Hey Nick, I find it concerning this account is. Frayed just to comment on this thread. And never even reply back to any of the real concerns. Here to hoping this is real person and actually created account out of concern and sharing.

egorfine 7mo ago

Paying customer since inception here. I presume the local ChatGPT.app has even more measures to prevent automation, right? Presumably privacy-invasive ones as it is customary these days? Is there a way I can opt out? I really, really, really don't like it.

radicality 7mo ago
The way I use the products something like this. My main account on my MacBook - ChatGPT website, codex cli. Then, a Mac VM running via UTM with shared writable dir - anything more ‘shady’ in terms of permissions and for playing with new ai apps - eg ChatGPT/Codex standalone apps, Atlas, Claude desktop app etc. Seems to work decently enough. And I do totally agree that there should be a way to opt out of all these privacy invasive measures, especially after paying $200/mo

lionkor 7mo ago

Hi Nick, first of all, very cool of you to respond here instead of letting us all sit in the dark. I think that's what makes HN special. That said, is it not a little bit weird that you want to protect yourself from scraping and bots, when your entire company, product, revenue, and your employment, depends on the fact that OpenAI can bot and scrape literally every part of the internet? So your moat is non-hydrated react code in the frontend?

Schiendelman 7mo ago
Don't beat up an engineer for decisions made by company leadership. It's really inappropriate.
- diebillionaires 7mo ago
  Yeah, no one is responsible for what they do as long as someone else tells them to do it.
- lionkor 7mo ago
  They decided to work at this company, I think it's a reasonable discussion to have?
- SilasX 7mo ago
  While I would generally sympathize on that front, it doesn't really apply here. None of the management-level desiderata he appealed to require that the user experience be broken this bad. There is very little bot deterrence from prevention of typing at that stage, while it heavily impacts user experience, especially on mobile. I elaborate here: https://news.ycombinator.com/item?id=47575982 https://news.ycombinator.com/item?id=47575982

witx 7mo ago

> These checks are part of how we protect our first-party products from abuse like bots, scraping, Do you guys see the irony here?

hosteur 7mo ago
They obviously get it. They just do not care.

nicbou 7mo ago

For what it's worth, I switched to Gemini because of the long ChatGPT load time. Gemini loads as fast as Google Search.

numlock86 7mo ago

> [...] we protect our first-party products from abuse like [...] scraping [...] what an odd thing to say for someone whose product is built entirely on exactly that

invalidusernam3 7mo ago

But why block the ui until then? Surely you can just not make any requests until the checks are complete?

prmoustache 7mo ago

> we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Isn't that how you build your service from the very start? How ironic.

wiseowise 7mo ago

> A big reason we invest in this is because we want to keep free and logged-out access available for more users. Thank you for the reply, Nick. It wouldn’t be a problem to disable the tracking for authenticated users then, would it?

lloydatkinson 7mo ago
It would because someone's KPI depends on number of tracked users lol
- matsemann 7mo ago
  If logging in disabled all checks, all bots would just spam-create users first. Of course it needs to run for all users, without it being necessarily nefarious.
  - toddmorey 7mo ago
    Paid users?

owebmaster 7mo ago

The reason why you did it is clear, why you guys settle down for such a poor implementation is why this thread exists

conartist6 7mo ago

Still feels very anti-consumer. If every company behaved like you do, the internet would be a much worse place. In fact, OpenAI has already made the Internet a much worse place, already much, much less open and much less optimistic about its own future than it was even five years ago...

deleted 7mo ago

[deleted]

aucisson_masque 7mo ago

Why send the Turnstile bytecode encrypted ? Surely people savvy enough to abuse the system will find out how to decrypt it, see OP, and it gives the impression that you are trying to hide stuffs you're not proud about.

pocksuppet 7mo ago
Because they want to make it as hard as possible to reverse engineer. If they wanted it to be easy, they'd use <input type="checkbox" name="ishuman">I am a human

marxisttemp 7mo ago

History will not be kind to you and your ilk. Quit your job.

sourcecodeplz 7mo ago

I really appreciate the free options, without even needing a login. Wish they would also keep the small free weekly allowance for Codex.

xtajv 7mo ago

Earnest question: if I was feeling lazy and security-conscious at the same time, would I be better off... (A) opening chatgpt.com in qubes (but staying logged out, i.e. never creating a chatgpt account) -or- (B) creating a freemium chatgpt account ? (Obviously, the "best" answer would be something like running a local LLM from an airgapped machine in a concrete bunker :) But that's not what I'm after).

20k 7mo ago

>abuse like bots, scraping 10/10, I've got no notes

boesboes 7mo ago

lol, hypocrites.

MisterTea 7mo ago

> These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Isn't this the same behavior used by AI companies to gather training data? Pot, meet kettle.

cheese_van 7mo ago

<protect our first-party products from abuse like scraping> Abuse from scraping has long been a serious problem for many, good job!

ryanmcbride 7mo ago

Protecting your site from bots and scraping is absolutely hilarious considering how you acquired (read: stole) the data you trained your bot on dude. Just yank that ladder up behind you.

pocksuppet 7mo ago
> Just yank that ladder up behind you. You would be an irresponsible entrepreneur if you didn't. Don't forget your legal obligation to maximise shareholder value.

blactuary 7mo ago

> I work on Integrity at OpenAI Irony is truly dead. Show you have integrity by quitting your job

mghackerlady 7mo ago

No, leave it. Surely the mighty OpenAI can deal with the scraping. At least, it seems to think everyone else can

leros 7mo ago

Fwiw, I stopped using ChatGPT and went to a competitor because the checks slow down ChatGPT so much that the webapp becomes unusable in anything but a new short chat. CPU usage goes to 100%, you can't type, the entire tab freezes, etc. It's a miserable experience to use and I'm on a relatively new MacBook not some old computer. If you read around it's a very common problem people have been having for a while now.

toddmorey 7mo ago

Why are all these checks still performed on an authenticated, paid user?

diebillionaires 7mo ago

As a free tier user I only get like three queries in now without model quality reduction, so I'd say your bases are covered as far as GPU costs around misuse.

lifis 7mo ago

Are you disabling them for paying subscribers?

throwaway613746 7mo ago

[dead]

matheusmoreira 7mo ago

> protect our first-party products from abuse like bots, scraping You do see the irony here?

ghm2199 7mo ago

Would OpenAI also consider renumerations to every site they have scraped that had a robots.txt file and they chose to ignore it anyway? Feel free to not answer this question. I have kind of lost count of how many content creators have said personally to me traffic is meaningfully down because of all these chatbots. The latest example is this poor but standup guy: moneyfortherestofus.com.

timeinput 7mo ago
I'm really glad Hacker News disallows AI generated comments. The response I got from asking that question really is quite enlightening. Short answer: "no", long answer: "no -- fuck off", longer answer: "no -- fuck off -- if you want I can dig into whether or not you should fuck off harder"

wackget 7mo ago

I understand it's not your area, but can you please politely tell your colleagues that the clickbait-type teaser questions from the latest model are absolutely infuriating and are quickly leading to me abandon the platform entirely? If you'd like, I can write a two-sentence paragraph to send to your colleagues. It contains a special phrase which most colleagues will find difficult to ignore. Would you like me to do that?

htx80nerd 7mo ago

Thanks. I've used ChatGPT a million times and never had any input issues.

rsrsrs86 7mo ago

Hi Nick, do you believe what you say? You scraped the shit out of everyone

SilasX 7mo ago

It has not been negligible for me, and, however you're doing this, there is significant room for improvement. There have been times when, across about ten minutes of usage, most of which is me typing on iOS Safari, it drained 15% of my battery. There is no functional justification for this beyond poor code quality. (It was on a long conversation FWIW.) This when I'm logged in, with a paid (Plus) account, connected to a very old email address with a real user profile. That can't be the result of super-clever bot defense measures, because it's merely an inconvenience on desktop. And if you genuinely believe that email has been compromised, why aren't you reaching out the to the account owner, as the account isn't otherwise connected to fraud by your heuristics? However brilliant the LLM agent it is, I'm seeing a lot of unforced errors regarding how you implement a web interface to it. If it makes you feel any better, it doesn't really register compared to all the bloat I see on other sites.

sandeepkd 7mo ago

You do not ever trust the client side. Sometimes being simple is good enough. The maximum you can do is put rate limits on the IP address and/or user account. You just do not want some one to use the product at machine speeds.

tempaccountabgd 7mo ago

[dead]

xg15 7mo ago

> how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. Are you applying the same standards to your own scraper bots?

AndrewKemendo 7mo ago

Kudos for trying This whole thread was like watching a swarm of ants try and take a grasshopper down

jesuslop 7mo ago

Hi Nick, the lag is quite bad in the field, honest. In desktop app in this case/datapoint. There was that "halt and catch fire" episode where they spoke about a millisencod threshold of delay that separated usability and non. Solvent hw and fiber connection.

opsdu 7mo ago

[dead]

account42 7mo ago

> These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. The lack of self awareness...

arendtio 7mo ago

Do you do those checks only for users without accounts or also for those with accounts?