Ask HN: Are people aware OpenAI Dots intercept SSL?
I've already cancelled my OpenAI subscription due to all their recent shenanigans. But before my month ends I thought I'd see what this Dot thing is all about. First thing I did was install Firefox to test out a project of mine (wouldn't work in Chrome). It failed to connect: > The cloud proxy uses an OpenAI certificate authority that the operating system already trusts, but the fresh Firefox profile doesn’t. The game’s connection verifies successfully against that existing authority. > May I add that same cloud certificate authority to this isolated Firefox test profile? Certificate validation stays enabled, but Firefox would then trust certificates issued by the cloud proxy. Wait. What? No. Of course not. Aren't Dots ostensibly designed for personal use? Accessing your email and the like. With this thing intercepting web traffic, I imagine almost everyone using these things are in violation of all sorts of policies and agreements.
Comments
2 preview comments · loading full threadLog in to h4cker, then connect Hacker News to publish comments.
Probably worth noting, yes, I'm aware if you're running atop their cloud infrastructure, OpenAI already technically have access to whatever they like. How would you feel about VPS providers enforcing this same policy? Yes, I'm also aware that if your data goes to their models for processing, you're of course already sending them your private data too. However, you may have noticed, Codex and the like actually go to pretty great lengths NOT to upload things like secrets to the model. This is the polar opposite approach. Isn't the idea of having a cloud computer meant to be that it's more than just a model? It provides compute, so it can run scripts locally to filter data etc.
[deleted]