Moving on...

Entrust your AI key to a closed binary? Bot what could possibly go wrong?

I'm not defending anyone here but just strace the program if you're really worried about it. If you don't know what strace is: it exports every syscall the program has made, so you'd see if it's doing anything suspicious.

Or don't use it, and warn others of the issues and let them decide if they want to use it.

Well I don't see why not, also I don't see which issues if you're not using it as you couldn't encounter any to begin with. Being closed source is not an issue.

Careful with the sarcasm. Only positive vibes are allowed on showHN or the admin goes ballistic. I've seen it happen.

> Only positive vibes are allowed on showHN

Sarcasm?

No. It's real. According to dang, showHN is suppose to be a "safe space". You could make absolute crap, everyone is suppose to be positive about it. Dang will flag people who don't do this.

Nothing dang can do though is hundreds of people hate it though. Things with actual security issues for example he'll likely just be quiet about it.

That is unfortunate. You would think that the intent behind posting ShowHN is to get constructive feedback but based on what you described, it appears that the expectation is to make those creators feel good instead.

You still can, just have to be excessively nice about it. Huge emphasis on excessively.

What could go wrong? It is static site and there is no backend, so the key is only in the browser.

It is open source. Your browser retrives all the JS and html sources. Even if it were somehow closed source, it doesn't really matter. You can view web requests and other, and see for yourself.

What Just because you can see HTML and JS that THE BACKEND SENT doesn't mean you can see the actual logic (code)

This is a static website, no backend.

All logic is clientside in the downloaded JS and HTML. After the initial page load, it should send nothing to the backend of the website, only API calls to chatGPT API itself.

Theoretically, you should block any outgoing connections to the website domain (after it loads all necessary HTML and JS), and it should still work fine. "Theoretically" because it might attempt delay-loading some static assets, but you get the idea.

The ability to reverse engineer the source through the browser doesn't make something qualify as open source anymore than reverse engineering a binary with some other tool.

I can view web requests but let's say on the 365th web request it sends my API key to an unknown location. How would I know if this was closed source?

Forgive me if I’m just being naive but couldn’t you look at the source from the browser dev tools?

Sure, if you're checking the first 365 requests or you get really lucky and just happen to look that time. Quite unlikely though.

It's not similar to a binary file, since re a binary file is a pain in the ass and looking at JS with some obfuscation is much easier.

Your example is valid, but it's like asking "how can I know that my iPhone doesn't record me while I'm sleeping?"

I trust apple over some random person on the internet.

If you're looking for an open source ChatGPT UI, I built one with React + Typescript:

https://github.com/cogentapps/chat-with-gpt

https://chatwithgpt.netlify.app/

why is the System Prompt reset after a few seconds!?

Just pushed a fix for this (refresh to get the update), let me know if it happens again!