Yet another Hacker News

39 points armcat 2 hours ago 24 comments

15o9o 2 hours ago | parent

we are getting to the point of “why have passwords?” Right? At some point soon we have to move to the honor system of just please don’t login as me?

dataviz1000 26 minutes ago | parent

> please don’t login as me

Please don't drain my $6.5 billion in Dogecoin.

jareklupinski 54 minutes ago | parent

> able to take over anyone's account simply by sending them a link

dont click links people

that'll be $500k for the security training pls

bossyTeacher 52 minutes ago | parent

Also many emails from tech companies today:

- "sign in via one-time code."

- "Click here to see our latest update".

jareklupinski 39 minutes ago | parent

dont click links

250k refresher fee

atrokhymchuk 21 minutes ago | parent

hey, don't dump the market

kotaKat 22 minutes ago | parent

"Scan this QR code!"

Razengan 23 minutes ago | parent

Thanks! Here, click on this link to get paid

TobTobXX 17 minutes ago | parent

... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."

[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...

kro 10 minutes ago | parent

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

dumberquestions 53 minutes ago | parent

Does no one write their own blogs anymore?

lifeisloving 23 minutes ago | parent

This one is particularly bad, like they probably made $7500 (not much tbh) for p1, atleast spend a few hours to write the blog post.

zx8080 23 minutes ago | parent

For who?

loveparade 15 minutes ago | parent

For the LLMs so they get new training data

lxgr 38 minutes ago | parent

Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad.

[1] https://news.ycombinator.com/item?id=50078284

usernametaken29 32 minutes ago | parent

Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it? All jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically… so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that’s correct and adhere to established engineering standards over sensationalised “we built so much code” promotional material.

Pannoniae 19 minutes ago | parent

it's not like microservices fare better, when you introduce them, you've traded a hard problem for a hard problem and distributed computing...

elendilm 10 minutes ago | parent

Reducing attack surface is a lesson for everyone. Newcomers are impressed by massive piles of code.

Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.

torben-friis 9 minutes ago | parent

Did you mean exponentially? Logarithmic increase doesn't sound too bad.

yellow_lead 19 minutes ago | parent

> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.

It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.

marwaneet 17 minutes ago | parent

Another classic OAuth implementation failure. Mismanaging the state parameter or leaking tokens via referer headers in redirects is Security 101. Wild to see this in a production environment of this scale.

steve1977 13 minutes ago | parent

Production scale is not production grade I guess...

atrokhymchuk 15 minutes ago | parent

if only they had some sort of cybersecurity state of the art thing...