Search.chatgpt.com domain and SSL cert have been created

[siva7]

Imagine being an innocent developer trying to spin up some internal dev tooling and accidentally landing on the front page of HN to be misinterpreted as an attack against google which could affect both stock

[wouldbecouldbe]

Ah well I like your joke, but I know GPT is moving fast, but it would be unlikely and innocent dev can change DNS records of chatgpt.com

[belter]

https://news.ycombinator.com/item?id=40234028

[beambot]

Sama & Lex Fridman literally talked about disrupting search in their latest podcast.

[skywhopper]

I hope they don't use this level of DNS to set up internal tooling.

[filleokus]

I'm taking this opportunity to once again ask for the widespread adoption of the Name Constraints extension in x509, and subsequent roll-out of constrained intermediate CA certs signed by a publicly trusted root.

Would be so convenient to have an intermediate CA cert constrained to *.my-name.com to avoid situations like this. Being forced to either use a private PKI infrastructure or using wildcards to not leak host names is so annoying.

[lambdaxyzw]

The point of certificate transparency is to have a public audit log of every certificate issued. Even if you had your own CA, you would be obliged to report every certificate you issue to the CT. This is a feature, not a bug.

[michaelt]

You can just buy a regular wildcard certificate for *.my-name.com

If your organisation is competent enough to handle an intermediate CA certificate safely, you're certainly competent to handle a wildcard cert safely which is a much easier task.

Sadly it's unlikely you'll ever see the Name Constraints extension adopted. All it takes is one model of 15 year old smart TV failing to respect it, and the CA/Browser Forum will consider it too dangerous to allow.

[lxgr]

This would be so great. It also just mirrors the DNS trust model nicely, which is what’s used for X.509 trust anyway by most CAs.

[supriyo-biswas]

Let’s encrypt and similar ACME compliant services allow you to get wildcard certs through their DNS-01 challenge.

[tru3_power]

As a red teamer I agree - I always found this ridiculous

[surfingdino]

It's a clever way of getting around the accusations of stealing content. They can say that they are scraping it to make it searchable, just like Google.

[toxik]

It will be interesting to see what happens to copyright claims against ChatGPT. Google can just remove claimed content from its index, what will OpenAI do?

[rany_]

I know about things like https://crt.sh but how could you be notified about something like this? Is there some service that allows you to be alerted whenever a new certificate is generated for a domain?

[w3ll_w3ll_w3ll]

There is this tool from Facebook.

"Certificate Transparencyis an open framework which helps log, audit and monitor publicly-trusted TLS certificates on the Internet. This tool lets you search for certificates issued for a given domain and subscribe to notifications from Facebook regarding new certificates and potential phishing attacks."

https://developers.facebook.com/tools/ct/search/

[arccy]

crt.sh has rss feeds for any search result you throw at it, e.g.: https://crt.sh/atom?identity=chatgpt.com

most commercial offerings are about monitoring your own domain, e.g. from cloudflare, sslmate, etc.

[lambdaxyzw]

You can set up your own certificate transparency listener, and get notified of every certificate created, in realtime, assuming you can handle the load. In my company we do this to scan new domains for potential phishing domains, to take them down before they become active.

[jacekm]

There is free service called Certstream [0]. It does not provide notifications, you need to ingest the stream, look for the patterns of interest to you and handle notifications by yourself. But it's fairly easy and the service is commonly used by security teams.

[0] https://certstream.calidog.io/

[raincole]

Easy, just refresh Hackernews front page 24/7.

[bakugo]

Cloudflare provides this as a feature, you can choose to get an email every time a certificate for your domain is generated.

[ChildOfChaos]

There is a rumour of an OpenAi event apparently next week, so likely what this is.

Some creators also seem to suggest they know what is going on, youtube mattvidpro hinted at it when talking about the gpt2-chatbot, he mentioned he knew something but couldn't talk about it or get sued.

[alexcanton]

is there a source for this outside 1 guy on twitter? If they were holding an event I would imagine invites would have gone out a while ago like their dev day..

[unraveller]

Search chatgpt ah but you repeat yourself, we already use LLMs to replace this antiquated notion of loading webpage snippets and pointing me in 5 different directions.

I'd say "just chatgpt it"? is closer to being in the lexicon and this url just doesn't roll off the tongue

>"here let me search.chatgpt that for you"

There I was hoping sama-gpt5-chatbot had some creativity chops for naming new things but they must have decided not to use it this time.

[snapcaster]

In my experience LLMs are terrible at naming things, usually some combination of cringe and silly

[shawabawa3]

> >"here let me search.chatgpt that for you"

Why would you say it like that though? You don't set "let me google.com that for you"

In the same way you don't say "let me chat.openai it for you", likely search.chatgpt.com will just become the new default interface to chatgpt, and "to chatgpt" something will mean to look it up on search.chatgpt.com

[ramshanker]

Just today, I was having difficulty with printing in AutoDesk software. Copilot(Previw) was right there at the bottom, I opened it and asked for steps to solve the issue. It told, in steps, exactly what to do, which worked as instructed. Solving my issue. The original article from AutoDesk was also linked. My immediate thinking was search is doomed.

Compare this to what I would have to do with google. Open browser, type the query, guess which of the top 10 results are likely to answer the issue I was having. Click few link to open them in new tab. Read though it to see if the correct problem was being discussed. If not see another link in the top 10 list. Repeat.

I even thought where in that interface, Microsoft could place the future ads. It's totally in the realm.

EDIT: At this point, ChatGPT is basically old school "I am feeling lucky" on steroids.

[kevindamm]

> Compare this to what I would have to do with google. Open browser, type the query, guess which of the top 10 results are likely to answer the issue I was having. Click few link to open them in new tab. Read though it to see if the correct problem was being discussed. If not see another link in the top 10 list. Repeat.

This is outdated. I repeated your experiment with Google query [how do I print from Autodesk] and the top result is the step by step instructions (not a link but the actual instructions, with a link to the source following). The second result is a link to Autodesk's own help docs for the print function. No ads above the fold.

But you make a point that people will keep assuming what they want to anticipate how the search will unfold, and I admit this is in part due to the enshittified commercial and news-related (and other) results, the bias is coming from somewhere, right? But I would encourage anyone to at least verify this assumption before posting it as fact.

[oleksiyav]

A new search system is coming. At least I've already seen about 50 visits to my website from ChatGPT.

[throwaway143829]

Why do you think this implies they are building a search service rather than just scraping your site for more training data?

[jmacd]

Altman has said explicitly on several podcasts that they are working on search and that it was something he is particularly excited about.

I am guessing that this falls under the "we will steamroll" clause of OpenAIs gradual move towards AGI.

[maxdaten]

On the other side he said, the "next Copy of Google Search" would be boring. So let's see what they try to make differently

https://youtu.be/jvqFAi7vkBc?t=4681

[EZ-E]

Wasn't ChatGPT already doing searches for you when relevant? For example if you asked for recent news? I can't get it to do it again for some reason it will share month old publications right now.

[kolinko]

That was through bing. And bing uses similar algorithms to google for ranking. OpenAI can do way better.

[lokicik]

Does this mean that the next gpt model could be online, like Gemini?

[lagniappe]

Sounds like they're building something like what Phind.com does

[t00ny]

Or maybe something like Perplexity AI.

[cynicalsecurity]

RIP Google. Yet another story of a company killed by "effective" management. The McKinsey school isn't so effective after all, is it.

[unraveller]

Can someone tell me how all that leet coding doesn't lead to their AI having better coding ability? More fizz buzz has been spilled on google whiteboards than in any other place on earth.

[robofanatic]

So does that mean my chat will be publicly searchable?

[bossyTeacher]

They would be open themselves to a class action lawsuit and no one would use their LLMs so I doubt it

[kolinko]

No

[seydor]

Isn't that conflicting with their microsoft deal?

[jsheard]

Unless this is the Microsoft deal, and they're using Bing as their indexing backend.

[theGeatZhopa]

Using azure bringing MS money. Even bing is not growing, the money comes in. If the search is good, it will explode and make MS buy more of hardware, making them the biggest cloud search. they can scale on it.

So the money will come in, that or that way.

[spiderfarmer]

Probably uses Bing to an extend.

[grandpoobah]

Ooo exciting :)

[andrewstuart]

Most underwhelming product launch ever.

[bossyTeacher]

what's the point of this post?

[belter]

Somebody has PUT options on Alphabet? :-)

[wildrhythms]

What makes you think an AI can't be gamed in the same ways?

[greenthrow]

Lmao what so you think the LLM is trained on? And the data set is frozen in the past because LLMs are polluting the web with generated garbage.

[seydor]

ChatGpt will happily sell you snake oil wrapped in your favourite flavor of BS

[01HNNWZ0MV43FF]

Tls, no?

[yau8edq12i]

There is no such thing as an "SSL certificate" or "TLS certificate". There are certificates, which are used in various protocols including SSL and TLS. You can use the same certificate for both. The name "SSL certificate" is just a shorthand indicating the intended purpose of the certificate, nothing more. As such there really is no point in being pedantic over SSL vs TLS.

[teddyh]

X.509

[cqqxo4zV46cp]

We all know what it means.

[justsomehnguy]

tty. World Wide Web.