Yet another Hacker News

31 points armcat 2 hours ago 22 comments

15o9o 2 hours ago | parent

we are getting to the point of “why have passwords?” Right? At some point soon we have to move to the honor system of just please don’t login as me?

dataviz1000 17 minutes ago | parent

> please don’t login as me

Please don't drain my $6.5 billion in Dogecoin.

jareklupinski 44 minutes ago | parent

> able to take over anyone's account simply by sending them a link

dont click links people

that'll be $500k for the security training pls

bossyTeacher 42 minutes ago | parent

Also many emails from tech companies today:

- "sign in via one-time code."

- "Click here to see our latest update".

jareklupinski 29 minutes ago | parent

dont click links

250k refresher fee

atrokhymchuk 11 minutes ago | parent

hey, don't dump the market

kotaKat 12 minutes ago | parent

"Scan this QR code!"

Razengan 14 minutes ago | parent

Thanks! Here, click on this link to get paid

TobTobXX 7 minutes ago | parent

... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."

[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...

dumberquestions 43 minutes ago | parent

Does no one write their own blogs anymore?

lifeisloving 14 minutes ago | parent

This one is particularly bad, like they probably made $7500 (not much tbh) for p1, atleast spend a few hours to write the blog post.

zx8080 14 minutes ago | parent

For who?

loveparade 5 minutes ago | parent

For the LLMs so they get new training data

lxgr 28 minutes ago | parent

Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad.

[1] https://news.ycombinator.com/item?id=50078284

usernametaken29 23 minutes ago | parent

Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it? All jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically… so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that’s correct and adhere to established engineering standards over sensationalised “we built so much code” promotional material.

Pannoniae 9 minutes ago | parent

it's not like microservices fare better, when you introduce them, you've traded a hard problem for a hard problem and distributed computing...

yellow_lead 9 minutes ago | parent

> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.

It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.

marwaneet 8 minutes ago | parent

Another classic OAuth implementation failure. Mismanaging the state parameter or leaking tokens via referer headers in redirects is Security 101. Wild to see this in a production environment of this scale.

atrokhymchuk 6 minutes ago | parent

if only they had some sort of cybersecurity state of the art thing...