• 0 Posts
  • 32 Comments
Joined 2 years ago
cake
Cake day: June 27th, 2023

help-circle

  • To be fair, they are talking about the OpenAI end user version, not the models themselves.
    Its still sketchy to send your data willingly to them and hope because you pay per request, its not getting tracked and saved.
    My company is deep into microsoft, so we all get Bing Chat Enterprise.
    Microsoft says it doesnt store anything and runs on separate systems… i guess with a company-offer they are more likely to put more protections in place because a breach would mean real consequences.
    (opposed to a breach with end-users, most of which dont care or would ever go through the legal trouble)




  • Magic lock icon is easy, hard is it to block attacks and being able to do very little about it.
    Spoofed packets, server providers not caring what their customers do, many abuse email adresses dont even work.
    Keyless SSL would be nice and i’d use it. I have my own keys, but its for Enterprise customers only.

    I am not using Cloudflare as i dont like them handling like 80% of all traffic. But as website owner i can understand why someone would still choose them…



  • Its nice when you are deep in Microsoft already from your company and get BingChat Enterprise included anyways.
    Its slower than OpenAI GPT4 at times and its alot more restricted, but it gets the job done mostly.
    You need to hack the UI to make it nice, unlock longer inputs, disable search tool at-will, disable synthetic streaming responses (consistent token speed, but takes longer overall)

    Simple query via DDG, complex stuff and ChatBot stuff via BingChat Enterprise.



  • afaik, most if not all modern browsers and clients in e.g. apps, use Diffie-Hellman key exchange in TLS.
    Some Apps go even further and implmement certificate pinning, only allowing a set of specific certificates the server is allowed to “present”.

    You can only break it by an active Man in the middle attack, presenting your own Diffie-hellman parameters toeachother and signing them with a certificate the client trusts (we can probably assume US agencies have access to some CA keys and can do this)

    I dont think this is very feaseable on a large scale as you’d need to intercept every interesting connection, break the handshake, risking detection, and further proxy and process the whole traffic.
    Metadata will be more juicy en mass than the content and easier to obtain with less risks.