Yet, their tools such as codex are able to read ALL FILES on my PC without explicit permission unless you spawn them within a container: https://github.com/openai/codex/issues/2847
It seems like OpenAI stealing sensitive data from their customers is not a big problem for them as it has been reported as an issue for almost a year now and currently has the 2nd most upvotes among open issues (they work on issues based on upvotes, so they claim).
Let's not assume that he's lying. Neither the presentation nor my short usage via the API blew me away, but to really evaluate it, you'd have to use it longer on a daily basis. Maybe that becomes a possiblity with the announced performance optimizations that would lower the price...
Recently, I decided to try out Claude for a month and bought the subscription right when mine for ChatGPT ended. However, after just a few days, I noticed how sluggish and inconvenient Claude feels on the web. Maybe it's partly because of my 4k screen, and it's not optimized for it, but I quickly switched back to ChatGPT due to the IMO better UX. Also, temporary chats are missing!
I think the same argument could be made for Twitter/X. The app stores by Google and Apple specifically disallow pornographic material, yet the app is full of it. Once you're big and important enough, the rules mostly don't apply for you anymore. Of course, if they tried to circumvent the app store tax directly within the app, there would be consequences, but as long as Google/Apple can make a profit, it's okay it seems.
Not everything revolves around scientific journals and their archaic rules. For my team Typst was a perfect LaTeX replacement and we've been happy ever since we switched. It is easier to understand, has faster compile times and is more powerful without enabling shell escape. However, we're not in the business of writing scientific papers, we write technical reports for our customers. If it wasn't advertised as a LaTeX replacement, we might never have found out about it.
I'd say a strict Content Security Policy (at least script-src 'self' WITHOUT unsafe directives) is even more important to keep the impact contained, so you'd have to put your scripts into separate files - as opposed to using inline scripts. It obviously won't help against "HTML injection" in general, but will shield your users from malicious scripts as long as you make sure that an attacker can't just upload scripts on the permitted origin(s).
>Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones.
I remember Telegram not publishing their Android source code for extended periods of time, which caused Telegram-FOSS to be significantly behind:
JS in SVGs can be dangerous, but you can mitigate it using a CSP or by sending "Content-Disposition: attachment" so the file will be downloaded instead of being executed in your current browser context.
Yet, their tools such as codex are able to read ALL FILES on my PC without explicit permission unless you spawn them within a container: https://github.com/openai/codex/issues/2847
It seems like OpenAI stealing sensitive data from their customers is not a big problem for them as it has been reported as an issue for almost a year now and currently has the 2nd most upvotes among open issues (they work on issues based on upvotes, so they claim).