Everything ChatGPT – under the hood of the ChatGPT web app | Hacker News Reader

Everything ChatGPT – under the hood of the ChatGPT web app

github.com

180 pointsaargh_aargh30 comments

This doesn't actually cover the most important part, which is where the response to a chat shows up. Has anyone figured this out? I only looked briefly, but AFAICT, it doesn't show up in the response data in Chrome or Firefox DevTools. I figured it was maybe using WebSockets or Server Sent Events, which apparently don't show up in DevTools in some cases (?). I think this is a Chrome bug [0] [1] and also a Firefox bug [2].

EDIT: It's using EventSource. If you open the debugger and Cmd+Shift+F for `onmessage`, you'll find where it receives the message, and you can add a breakpoint, which you can then right click and change to a logpoint, to log the contents of the message. There is probably a one-liner you could paste into devtools to do some prototype hacking of window.EventSource, but I don't have time to figure that out atm, and can't find anything in a few quick searches of GitHub code.

EDIT EDIT: Just tried Safari, it does indeed show up as a spinner, but I still can't see the actual messages in DevTools.

[0] https://github.com/Yaffle/EventSource/issues/79

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=102589...

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1405706

Shows up in Safari as Content-Type: text/event-stream on the https://chat.openai.com/backend-api/conversation endpoint.

You can see the network call spin while the text loads.

edit: added name of endpoint.

The URL you linked says

    {"detail":"Method Not Allowed"}

When I click on it

You aren’t supposed to click on it, that won’t work. It’s the endpoint that’s showing up in the network tab.

Clicking it won't do anything. It's a POST request endpoint so you also have to provide the auth token and input.

Probably because they're using a polyfill[0][1] to handle the event stream.

[0] https://stackoverflow.com/questions/55201372/event-stream-da... [1] https://github.com/EventSource/eventsource/issues/94

And that's because the native EventStream API only supports GET requests, so if you want to use a POST request (which make more sense in this context) you have to use a custom implementation...

they are using Server Side Events (SSE) to stream the text.

see API docs: https://platform.openai.com/docs/api-reference/chat/create

> If set, partial message deltas will be sent, like in ChatGPT. Tokens will be sent as data-only server-sent events as they become available, with the stream terminated by a data: [DONE] message. See the OpenAI Cookbook for example code.

Interesting. Apparently server-sent events show up in devtools under the network tab as multiple responses sent for the same request.

https://firefox-source-docs.mozilla.org/devtools-user/networ...

https://stackoverflow.com/a/46075339/6417784

(Creator of the repo here) That is somewhat present in the `/backend-api/moderations` endpoint where the app sends your question + ChatGPT's response to (first time just your question, second time both)

The web app also has built in support for LaTeX rendering (it uses KaTeX). See this forum post: https://community.openai.com/t/new-feature-properly-shown-ma...

You can get ChatGPT to output conforming LaTeX expressions using the following prompt:

Could you please use the specific LaTeX math mode delimiters for your response?

LaTex math mode specific delimiters as following

1. inline math mode : `$` and `$`

2. display math mode: insert linebreak after opening `$$`, `\[` and before closing `$$`, `\]`

Super nice, thanks for posting this!

In some of the ChatGPT client-side JS (visible in the Debugger tab of DevTools), I could see references like `\triangle`. However, asking ChatGPT to print either as it is just prints the text itself.

This prompt works best with GPT 4. GPT 3.5 gives inconsistent results. There might be a way of improving the prompt for 3.5

Turns out, this actually does work.

Is anyone else hit by the Cloudflare "Confirm you are a human" captcha everytime they try to access ChatGPT? It's the only website where it happens to me: and I have to try several times before I get access.

Yep, constantly. Pretty much whenever I reload the tab.

Yes. Using iPad and iCloud Private Origin. I hit it every. single time

Interesting—so it seems there is an 'exploit' which lets non-Plus subscribers hit an internal API endpoint to send themselves a special Plus login URL (for times of peak demand): https://github.com/terminalcommandnewsletter/everything-chat...

I've not tested it further, but I wondered what happened when I saw a "Plus subscriber login link" input field - resulted in that. In fact, I wonder if one could automate the request to the API endpoint (all headers, authorization and everything) when the browser sees a "ChatGPT down" message. (Of course, you have to click the link in the email, but if you grant the tool access to your email to automate that, that probably isn't the best thing for "principle of least privilege")

> When you click Delete on a conversation, a PATCH request is made to /backend-api/conversation/05[redacted]2d with the body is_visible: false and gets a response of success: true back. This implies that a conversation is being soft-deleted, not deleted on their systems.

Ah yes, lying to the users by showing them a "trash" icon and actually just hiding the conversation from them.

What a superb way to build trust from your ivory tower of moral self-righteousness about how you've decided an language model can and cannot be used (which includes such hilarious bullshit as the model declaring it cannot make jokes about any particular group when asked to make a joke about women, but happily making jokes about men all day long.)

Why would anyone expect that their conversations with ChatGPT are confidential to the point where you could just delete the logs and pretend you never asked?

Trash is just to drop it from your history, I don't care to keep every conversation, and I also don't care if OpenAI keeps a copy, why should I?

Broadly speaking, European citizens probably have a reasonable expectation for data deletion as per GDPR.

I say broadly because I don’t necessarily think this particular UI interaction gives the impression of permanent data deletion.

Seems like deleting an email in most mail clients where it ends up in the trash.

Or the same UX in filesystems.

I think trying to make up some kind of moral outrage over this is a stretch.

I found some interesting stuff in the first minified bundle for ChatGPT - dead code for unreleased(?) features: https://twitter.com/brain_exe_ai/status/1607569864331493376

Including screenshots of the splash screen I made to display with some tedious editing of the min'd js https://twitter.com/brain_exe_ai/status/1607573641264234496

(Creator of the repo here) The repo now has some client-side JS (unminified). https://github.com/terminalcommandnewsletter/everything-chat...

(Creator of the repo here) Likely ONLY due to HN, the stats for the repo have BLOWN UP in the last day. It went from ~200 unique visitors and visits in one day to 8,689 unique visitors with 10,000+ total visits!

The website also calls the moderation API from the client side with the response returned from its conversation API. So if you simply block the request to the moderation endpoint in dev tools, do they still have additional built-in monitoring?

If you block the `/backend-api/moderations` endpoint, that (as expected) doesn't block the AI from not giving you an answer.

Interesting that the website is in Nuxt and the chat app is in Next. You see this tech everywhere on the web these days.

Reply on news.ycombinator.com