Re:GPT-4 API General Availability
by ftxbro on Thursday July 06, 2023 @09:04PM
(#36625635)
are we out here typing our api keys into random pips and am i a boomer that i would be hesitant to do it
[ Parent
| on HN ]
It’s not a “random pip”. The maintainer is a well-known open source developer (one of the creators of Django and Datasette). It’s also a very small codebase – not many places for malicious code to hide.
OK but I mean I don't know them and it could have been someone pretending to be them, and probably it's easily possible to trick me about API keys. We are discussing it on a hacker news website do you seriously think tricks couldn't be hidden in a repo like that.
Re:GPT-4 API General Availability
by bestcoder69 on Thursday July 06, 2023 @10:29PM
(#36626298)
https://github.com/search?q=repo%3Asimonw%2Fllm%20OPENAI_API...
Let us know what you find.
I found a few github issues related to api key security and management. I'm not 100% sure of your point.
Re:GPT-4 API General Availability
by jabradoodle on Friday July 07, 2023 @08:15AM
(#36630544)
I see no open issues.
It's around 1k lines of python, audit the code if you care and rotate your keys.
Or don't use it.
Do you only use software by people you know? At some point there has to be an element of trust when you run software you downloaded over the Internet. If a small utility maintained by a well-known member of the developer community doesn’t qualify for that trust, then I think that rules out an awful lot of software that all of us here probably use on a day to day basis. This is not an extraordinary level of risk.
> "well-known member of the developer community"
OK sorry I didn't know them.
I mean I usually use software that came with my computer or ones that I apt-install from the official ubuntu distribution. I know it's not perfect security but at least it's more than a hacker news link to a github pip. If I had to use other ones then it's usually from people I know.