Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

241–250 of 267 posts

Re: The scariest "user support" email I've received

#241

Post by BeFlatXIII »

drweevil wrote: post #236
mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

There is a (temporary) misalignment of incentives. ChatGPT is cheap--for now. But it cannot remain so for long. Someone(s) will have to pay for those huge datacenters and the gigawatts of power they require, and the investors speculating on them.

I hope it's the investors who end up paying because customers are too cheap.

Re: The scariest "user support" email I've received

#242

Post by 63stack »

famouswaffles wrote: post #235
63stack wrote: post #203

Earlier quoted context omitted.

ChatGPT failed at doing the job, and it was the wrong tool to use. It explained that it saves a file and executes it. That's a nothingburger, it was obvious it's going to execute some code. The actual value would have been showing what's in the executed file, but of course it didn't show that (since that would have required actually executing the code). Showing the contents of the file would have provided an exact an…

So what exactly did it fail at here ? Not executing the clear malware attack just so it could it see what was inside ? Really ?

Explaining what the malware does

Re: The scariest "user support" email I've received

#243

Post by radu_floricica »

justinclift wrote: post #206
radu_floricica wrote: post #205

Earlier quoted context omitted.

To most of the replies to my comment, the point is that: - ChatGPT is _satisficing_, not optimal. It's definitely worse than a dedicated decoder tool. - and it's also much more versatile, so it will be satisficing a large array of tasks. So in scenarios where precision isn't critical and the stakes are mid, it'll simply become the default tool. Like googling something instead of checking out wikipedia. Or checking ou…

> ChatGPT is _satisficing_, not optimal. But is it _always_ accurate? The answer to that is important when there are security implications.

The security implication here was writing a blog post. You're allowed to use a cheap box cutter even if you work at NASA, as long as you use it to open mail. That's what satisficing means.

Re: The scariest "user support" email I've received

#244

Post by jb1991 »

account42 wrote: post #208
jb1991 wrote: post #162

Earlier quoted context omitted.

You are forgetting the world we live in now where, as time passes, fewer and fewer people will know how to do anything on their own and more and more will only accomplish things by using AI.

And we should call out and shame that behavior wherever we can just like our teachers were not amused when we simply copied from a Wikipedia article instead of following the referenced sources.

I don’t disagree, but the problem is, in the very near future the people who are the teachers who should be calling out this behavior will be the ones who have relied on it.

Re: The scariest "user support" email I've received

#245

Post by closewith »

JohnFen wrote: post #237
closewith wrote: post #197

Earlier quoted context omitted.

Can you grow your own food? Treat your own injuries? Build your own shelter? Repair your own appliances? If not, you're already much farther down this dependency funnel that you believe.

Yes, to all of the above. So can a lot of the people I know.

And many more can not, and all are more important skills than cursory knowledge of operating systems.

Re: The scariest "user support" email I've received

#246

Post by famouswaffles »

63stack wrote: post #242
famouswaffles wrote: post #235

Earlier quoted context omitted.

So what exactly did it fail at here ? Not executing the clear malware attack just so it could it see what was inside ? Really ?

Explaining what the malware does

I mean, what exactly would decoding the string yourself change ? It's not as if b64 decoding has secret malware introspection abilities.

Re: The scariest "user support" email I've received

#247

Post by roflchoppa »

mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

Why not? its a good use of ChatGPT, just throw the text at it, and let it figure out whats going on. It's not me executing code on my machine, or accidentally executing code.

Re: The scariest "user support" email I've received

#248

Post by Apocryphon »

foxrider wrote: post #161
duskwuff wrote: post #70

Earlier quoted context omitted.

> the personal website that would be casually hosted whenever your PC is on I don't think that was ever really a thing. Which isn't to say that no one did it, but it was never a common practice. And free web site hosting came earlier than you're implying - sites like Tripod and Angelfire launched in the mid-1990s, at a time when most users were still on dialup.

Must be a regional thing, because where I live, mass internet adoption pretty much started in the 90s with the dedicated Ethernet connections. As such, every PC had its own IP address, it was a time before home routers. Later, the dreaded NAT was introduced, but the ISPs kept their "LAN" networks free. People hosted all sorts of things. It was a common practice for people to host an FTP server, a game server, an IRC…

Do you live in DARPA

Re: The scariest "user support" email I've received

#249

Post by 63stack »

famouswaffles wrote: post #246
63stack wrote: post #242

Earlier quoted context omitted.

Explaining what the malware does

I mean, what exactly would decoding the string yourself change ? It's not as if b64 decoding has secret malware introspection abilities.

It already decoded the string so I'm not sure what your question is.

There is 0 value in chatgpt telling you "it executes some code". The interesting part would be what is inside the /tmp/... file that the malware intends to execute.

To turn this question around, what did you gain by asking ChatGPT this question? You would have not run this command before, and you wouldn't run it after, and you wouldn't have run it either if ChatGPT told you "yeah it's safe go ahead".

Re: The scariest "user support" email I've received

#250

Post by famouswaffles »

63stack wrote: post #249
famouswaffles wrote: post #246

Earlier quoted context omitted.

I mean, what exactly would decoding the string yourself change ? It's not as if b64 decoding has secret malware introspection abilities.

It already decoded the string so I'm not sure what your question is. There is 0 value in chatgpt telling you "it executes some code". The interesting part would be what is inside the /tmp/... file that the malware intends to execute. To turn this question around, what did you gain by asking ChatGPT this question? You would have not run this command before, and you wouldn't run it after, and you wouldn't have run it e…

What you would have liked to see is besides the point. Nowhere did the author tell us he was interested in finding out what running the code would do rather than what the string said. So there's no failure here, and the 'right way' people are bringing up here (decoding b64 algorithmically) would produce no more meaningful a result.
Post reply on HN