Hacker News Reader

Comment by abujazar | Hacker News Reader

The disclosure is provides valuable information, but the introduction suggests someone else or «open-source» is to blame:

>We took ChatGPT offline earlier this week due to a bug in an open-source library which allowed some users to see titles from another active user’s chat history.

Blaming an open-source library for a fault in closed-source product is simply unfair. The MIT licensed dependency explicitly comes without any warranties. After all, the bug went unnoticed until ChatGPT put it under pressure, and it was ChatGPT that failed to rule out the bug in their release QA.

View on HN

They are not suing anybody, just because it’s open source doesn’t mean talking about bugs is taboo. It reads to me like raw information, very good. They said they contacted authors helping with upstream bug fix. It’s great example how to deal with this kind of problems if anything to me.

I agree it's a good example – if not great. But considering OpenAI itself is as closed source as can be, mentioning open-source software as the cause of their outage in the very first line of their statement seems somewhat out of place. I don't think it's a coincidence that the open-source comes in the opening line while the acknowledgement to the Redis team is at the very end. Many outside of software engineering might read this as «open source caused OpenAI to crash».

Ironically, this sort of insane takes everywhere on the thread is causing more harm towards the image of open-source developers than OpenAI or anyone could ever do with their press release. It's important to mention whatever open-source library caused a bug because that could be happening in many other applications that are using it. That's basically one of the main points of open-source.

What would your opening sentence have been?

It’s a great opening sentence. Short, factual explanatory. You would have to be hypersensitive to object.

As far as I can see, the whole thing is a reaction to OpenAI not being sufficiently open - which is a fine argument to have with them, but shouldn’t cloud judgement on the quality of this write-up

i'm not the person you replied to, but i'm guessing maybe they'd have preferred:

"We took ChatGPT offline earlier this week due to a bug in an external library which allowed some users to see titles from another active user’s chat history."

Thanks for that reply - yeh, that's a reasonable alternative.

But the bug resided in an open source library, not their own code. What else could they say?

Bugs will always exist whether you have a QA dept or not.

Shifting the blame to open source isn't a good look. I like what Bryan Cantrill had to say about it: https://twitter.com/bcantrill/status/1638707484620902401

Spot on

The blame wasn’t “shifted”. The source of the bug was reported

https://twitter.com/danielbln/status/1639535353634643968?s=2...

They're not blaming anyone. Objectively there was a bug in that library that caused the problem.

Why mention it is open source then? What does that add?

"there was a bug in an outside library that we used" does not mention open source but has the same meaning, and would probably provoke the same complaints ("they're trying to blame somebody else for their problem").

In that case, though, they could say "look, we used a popular open source library because we had more faith that it would be better tested and correct" which would be a compliment to open source. That's essentially the information that we have.

In today's world, who builds anything from anything close to stratch? embedded developers, probably come closest. It's no worse or better to say "there was a bug that our release uncovered." If they continue to announce as many details as possible, we as the audience can develop a sense whether they're creating bugs or just uncovering bugs we're glad to know about.

I think it's fair to mention the bug originated in redis-py, but I don't find it relevant at all to mention «open-source» in the opening line of the public statement about the outage. Or «outside library» for that matter. It was ChatGPT release QA that failed, and then they failed to admit it.

It might be redis-py originally and someone at public relations advised to replace it with something more general so that it would sound being nice.

"given enough eyeballs, all bugs are shallow" is a compliment to open source, and telling your users that you use open source is a positive reassurance on other dimensions as well; it's relevant, and the truth is always relevant; there's no harm in mentioning it.

"Release early, release often" and "move fast and break things" are respected ideas that diminish the importance of QA. The more effective and efficient any QA you do is, yes, very valuable, and QA that finds broken things, all the better. But don't move slow is an OK compromise.

On the other hand, why overthink it?

why not mention it? What does mentioning it subtract?

«Open source» was in the opening line of the statement as if it was something to blame.

They're not blaming, legally speaking. But they're communicating that open source software caused their outage. OpenAI chose to use software that explicitly came without warranties, and are legally solely responsible for problems caused by open-source libraries they choose to include in their product.

I understand where you're coming from. But there is certainly an audience for this kind of post that would like to read about the objective source of the bug without connecting it to some expectations around responsibility.

I read this post, and I don't see it assigning blame to anyone other than themselves. See this bit copied from the post:

> Everyone at OpenAI is committed to protecting our users’ privacy and keeping their data safe. It’s a responsibility we take incredibly seriously. Unfortunately, this week we fell short of that commitment, and of our users’ expectations. We apologize again to our users and to the entire ChatGPT community and will work diligently to rebuild trust.

The facts could be more clearly stated by defraining from stating open-source software as the cause.

The questionable part is saying "open source". They refrained from naming the library, which is good; but then why bring up that one fact about it right after?

If someone asked ChatGPT to generate some code, then copy and pasted it mindlessly into their project, I wonder what OpenAI would think about the claim:

"The bug was a result of faulty code produced by ChatGPT."

Using an open source library is like copy and pasting code into your project. You assume responsibility for any pitfalls.

I mean they’re pretty clear with their warnings about accuracy.

Just like any author of MIT licensed open source software is clear about their license which clearly states they are not responsible in any way whatsoever for the shortcomings of their licensees.

Come to think of it, I think that's realistically going to happen a lot.

It's going to be recursive blaming all the way down.

According to this is not fixed yet... https://github.com/redis/redis-py/issues/2624

I don't recall anyone advocating omitting the name log4j when that security bug dropped in 2021. How is that situation materially different from this? redis-py fixed the behavior so it's definitely not the case of working-as-intended.

To be clear, I would be up in arms if OpenAI was trying to hold redis potentially legally responsible.

Damn open source! Those guys aren't living to their paychecks, I foresee staff cuts...

I understand and agree that framing open source as the issue is ridiculous. They may be redeemed though through the likely scenario that they didn't write this - GPT probably did. Perhaps their GPT doesn't like open source. :D

I am curious how you would have phrased it? Is there a way to accurately convey the root cause of the problem (the redis-py library) without sounding like trying to shift blame?

there was a bug on our codebase...

But then you don't get the goodwill of helping the open-source library fixing the bug, contributing back to the community.

Did you read the technical details? This was a bug in the way Redis-py handled requests that were cancelled before a response was returned to the user.

So? You own the stack. All that had to be said was there was a bug in the way requests were handled in a library. The open source part is not even needed.

I think the mention of exactly where is useful to this audience. Other people using the same open-source library might realize --- oh, we've run into that bug but never realized it. Low probability, sure, but nonetheless.

OpenAI could have simply named the library up front instead of stressing that it is open source. This would have alerted people who use the library while at the same time avoiding the suggestion that it being open source was part of the problem.

They tweeted few days back there was a bug in an open source library. That's the main issue.

Yes, and this is still the sole responsibility of OpenAI. They chose to include redis-py without warranties and are responsible for their own QA on any product built on it.

I reject the premise this is a bug. The author picked this implementation with whatever side effects. The author might want some requests to cancel in some situations. It's upto OpenAI to decide if the implementation works for their setup.

Maybe they should let ChatGPT craft the postmortem

Maybe they already did

I prefer accuracy over placating your public relations ego

The only counterpoint I would take is one related to the accuracy of what they wrote

This shows that LLM AI, as dangerous as OpenAI says it is, cannot be entrusted to OpenAI for safeguarding its use.

The phrase you quoted doesn't blame anyone, it just shows causation. Causation and moral responsibility are not the same thing.

Reply on news.ycombinator.com