Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ChatGPT won't let you type until Cloudflare reads your React state

buchodi.com

Post reply on HN
Print view View original

151–160 of 668 posts

Re: ChatGPT won't let you type until Cloudflare reads your React state

#151

Post by geetee »

angoragoats wrote: post #135
MyNameIsNickT wrote: post #76

Earlier quoted context omitted.

Yep, on logged-in users too. The reason is basically the same: we want scarce compute going to real people, not attackers. Being logged in is one useful signal, but it doesn’t fully prevent automation, account abuse, or other malicious traffic, so we apply protections in both cases.

Nothing you do can fully prevent automation. Someone who wants to automate requests badly enough will be able to do it, especially when the “protections” are as easy to decrypt and analyze as the OP proved. Meanwhile, the rest of us (well, not me, because I don’t use your garbage product, but lots of others do) have to suffer and have our compute resources used up in the name of “protection.”

[flagged]

Re: ChatGPT won't let you type until Cloudflare reads your React state

#152

Post by darepublic »

simonw wrote: post #6

Presumably this is all because OpenAI offers free ChatGPT to logged out users and don't want that being abused as a free API endpoint.

Using 5.2 at 20 a month would also be a steal. Other shoe will drop on codex sooner or later

Re: ChatGPT won't let you type until Cloudflare reads your React state

#153

Post by singpolyma3 »

pera wrote: post #110
dev1ycan wrote: post #89

Earlier quoted context omitted.

"abuse like bots, scraping, fraud, and other attempts to misuse the platform" This has to be a joke, right?

I really can't tell for sure (new user posting a ridiculously hypocritical corporate message on a Sunday) but if GP actually works for OpenAI the lack of self-awareness is seriously striking

How?

Re: ChatGPT won't let you type until Cloudflare reads your React state

#154

Post by tshaddox »

0x3f wrote: post #79
everdrive wrote: post #69

Earlier quoted context omitted.

It's getting to the point where a user needs at minimum two browsers. One to allow all this horrendous client checking so that crucial services work, and another browser to attempt to prevent tracking users across the web. Nick, I understand the practical realities regarding why you'd need to try to tamp down on some bot traffic, but do you see a world where users are not forced to choose between privacy and function…

Meet me in a cafe and I will sign a JWT saying you're not a bot. You can submit this to whoever will accept it.

Doesn’t really make sense, because any service can just say “you must paste your human-attestation JWT here to use this service” and plenty of people will.

Re: ChatGPT won't let you type until Cloudflare reads your React state

#155

Post by 3form »

angoragoats wrote: post #135
MyNameIsNickT wrote: post #76

Earlier quoted context omitted.

Yep, on logged-in users too. The reason is basically the same: we want scarce compute going to real people, not attackers. Being logged in is one useful signal, but it doesn’t fully prevent automation, account abuse, or other malicious traffic, so we apply protections in both cases.

Nothing you do can fully prevent automation. Someone who wants to automate requests badly enough will be able to do it, especially when the “protections” are as easy to decrypt and analyze as the OP proved. Meanwhile, the rest of us (well, not me, because I don’t use your garbage product, but lots of others do) have to suffer and have our compute resources used up in the name of “protection.”

Yeah, that's it. Also, it is a bit amusing to me - "We want to prevent automation", says the employee of Let's Automate Inc.

Re: ChatGPT won't let you type until Cloudflare reads your React state

#156

Post by madrox »

everdrive wrote: post #69
MyNameIsNickT wrote: post #49

Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. A big reason we invest in this is because we want to keep free and logged-out access available for more users. My team’s goal is to help make sure the limited GPU resources are going to real users. We also keep a very close…

It's getting to the point where a user needs at minimum two browsers. One to allow all this horrendous client checking so that crucial services work, and another browser to attempt to prevent tracking users across the web. Nick, I understand the practical realities regarding why you'd need to try to tamp down on some bot traffic, but do you see a world where users are not forced to choose between privacy and function…

I am not Nick, but there's a few ways that world happens: the free tier goes away and what people pay for more correctly reflects what they use, this all becomes cheap enough that it doesn't matter, or we come up with an end to end method of determining usage is triggered by a person.

Another way is to just do better isolation as a user. That's probably your best shot without hoping these companies change policies.

Re: ChatGPT won't let you type until Cloudflare reads your React state

#157

Post by mememememememo »

everdrive wrote: post #69
MyNameIsNickT wrote: post #49

Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. A big reason we invest in this is because we want to keep free and logged-out access available for more users. My team’s goal is to help make sure the limited GPU resources are going to real users. We also keep a very close…

It's getting to the point where a user needs at minimum two browsers. One to allow all this horrendous client checking so that crucial services work, and another browser to attempt to prevent tracking users across the web. Nick, I understand the practical realities regarding why you'd need to try to tamp down on some bot traffic, but do you see a world where users are not forced to choose between privacy and function…

Local models for privacy.

You want to go to the world's best hotel? You are gonna be on their CCTV. Staying at home is crappier but private.

Unfortunately for the first time moores law isn't helping (e.g. give a poor person an old laptop and install linux they will be fine). They can do that and all good except no LLM.

Re: ChatGPT won't let you type until Cloudflare reads your React state

#158

Post by thisisnow »

CorneredCoroner wrote: post #96

> A headless browser that loads the HTML but doesn't execute the JavaScript bundle won't have them. this is meaningless btw. A browser headless or not does execute javascript.

Hah, sure, you just let random JS execute from random sites on your machine...

Re: ChatGPT won't let you type until Cloudflare reads your React state

#159

Post by zdragnar »

DenisM wrote: post #138
halflife wrote: post #70

Earlier quoted context omitted.

Don’t know if it’s related to the article, but the chats ui performance becomes absolutely horrendous in long chats. Typing the chat box is slow, rendering lags and sometimes gets stuck altogether. I have a research chat that I have to think twice before messaging because the performance is so bad. Running on iPhone 16 safari, and MacBook Pro m3 chrome.

In the good old days Netflix had "Dynamic HTML" code that would take a DOM element which scrolled out of view port and move it to the position where it was about to be scrolled in from the other end. Hence he number of DOM elements stayed constant no matter how far you scroll and the only thing that grows is the Y coordinate. They did it because a lot of devices running Netflix (TVs, DVD players, etc) were underpower…

> Hence he number of DOM elements stayed constant no matter how far you scroll and the only thing that grows is the Y coordinate.

This is generally called virtual scrolling, and it is not only an option in many common table libraries, but there are plenty of standalone implementations and other libraries (lists and things) that offer it. The technique certainly didn't originate with Netflix.

Re: ChatGPT won't let you type until Cloudflare reads your React state

#160

Post by perching_aix »

lxgr wrote: post #140
perching_aix wrote: post #56

Earlier quoted context omitted.

For better or for worse, CF's fingerprinting and traffic filtering is a lot more in-depth than just IP trend analysis. Kind of by necessity, exactly because of what you mention. So I'd think that's not as big a worry per se.

Yet here I am drowning in captchas every once in a while, so it's quite a big worry for me. Maybe I just have to disable all ad blockers and Safari tracking prevention? Or I guess I could send a link to a scan of my photo ID in a custom request header like X-Please-Cloudflare-May-I-Use-Your-Open-Web?

> Yet here I am drowning in captchas every once in a while, so it's quite a big worry for me.

I think I was sufficiently clear that I was specifically talking about CGNAT-caused IP address tainting being an unreasonably emphasized worry, not the worry about their detections overall misfiring. Though I certainly don't hear much about people having issues with it (but then anecdotes are anecdotal).

> Or I guess I could send a link to a scan of my photo ID in a custom request header like X-Please-Cloudflare-May-I-Use-Your-Open-Web?

Sounds good, have you tried?

Not sure what's the point of these comically asinine rhetoricals.

Post reply on HN