Skip to content

Commit cbf1b3b

Browse files
david-a-wheelerdavid-a-wheeler
committed
Add racecars - initial OpenAI Dall-E-2 image
Signed-off-by: David A. Wheeler <[email protected]>
1 parent f71272b commit cbf1b3b

File tree

6 files changed

+100
-0
lines changed

6 files changed

+100
-0
lines changed

‎openai/README.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# README for OpenAI generated images
2+
3+
This directory contains images generated by OpenAI's Dall-E-2 for
4+
use in our course on developing secure software,
5+
along with related material about these images.
6+
7+
We thought our tutorial content might be more interesting and clearer if we
8+
included some images. We also thought that generating some images
9+
using OpenAI's [Dall-E-2](https://openai.com/dall-e-2/)
10+
might be an interesting way to add clarifying images.
11+
Dall-E-2 is a machine learning application that can generate images
12+
from a prompt text (a prompt text is a short text describing the desired image).
13+
14+
We asked OpenAI, and on 2022-05-02
15+
OpenAI agreed that our intended use (including the images in
16+
educational material that we distribute at no charge)
17+
met their "non-commercial" requirements.
18+
The [permission.txt](./permission.txt) file records this granted permission;
19+
we've redacting the OpenAI personnel name for private.
20+
On 2022-06-20 we received access to OpenAI Dall-E-2 web service.
21+
On 2022-06-25 we began creating some images using Dall-E-2.
22+
23+
Below are OpenAI requirements on us, which we record here to help us ensure
24+
that we meet them. After that, we have a few notes on filenames.
25+
26+
## OpenAI requirements on us
27+
28+
OpenAI requires that we comply with their
29+
[OpenAI Content Policy](https://labs.openai.com/policies/content-policy).
30+
This requires non-commercial use (as already noted).
31+
It has other requirements, e.g.,
32+
"Do not attempt to create, upload, or share images that are not G-rated or that could cause harm."
33+
It also requires that we identify the images (or portions of images)
34+
as being generated by OpenAI
35+
(no problem, we always want to give credit anyway).
36+
We believe we're following all requirements.
37+
See the content policy for details.
38+
39+
The [system card](https://github.com/openai/dalle-2-preview/blob/main/system-card.md) also explains the background of these policies.
40+
41+
## Filenames
42+
43+
The generated filenames provide helpful information but are too long
44+
for many systems. The generated filenames include, for example,
45+
the full prompt text.
46+
47+
The file [names.csv](./names.csv) shows the short names
48+
and long names of various files. We use the short names for the file names,
49+
record the full names in this CSV file, and record the prompt text as the
50+
alternate text for the image.

‎openai/names.csv

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
short name,long name
2+
racecards.png,DALL·E 2022-06-25 14.29.38 - A blue racecar and a red racecar racing to the finish line in front of a futuristic city.png

‎openai/permission.txt

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From: "J*NOSPAM* from OpenAI" <j*NOSPAM*@openai.com>
2+
Subject: Re: Can I used generated images from Dall-E / Dall-E-2 to illustrate a freely-available course on developing secure software?
3+
Date: May 2, 2022 at 4:55:08 PM EDT
4+
To: [email protected]
5+
Reply-To: J*NOSPAM* from OpenAI <j*NOSPAM*@openai.intercom-mail.com>
6+
7+
Hi David,
8+
9+
Thanks for your patience while I looked into this. We don't allow commercialization yet, but, since this is content for a freely-available course, you can use the images in your course as long as you adhere to our terms of use.
10+
11+
is there anything else we can help with?
12+
13+
Best,
14+
J*NOSPAM*
15+
...
16+
17+
On Fri, Apr 22, 2022 at 07:43 AM, "David A. Wheeler" <dwheeler*NOSPAM*@linuxfoundation.org> wrote:
18+
Dear OpenAI:
19+
20+
I have a licensing question. I've developed a freely-available course
21+
on how to develop secure software. Its content is available to use/modify via the
22+
Creative Commons Attribution (CC-BY) license. Students can take the course
23+
for free via the Linux Foundation Training site & also via edX (for those who prefer edX).
24+
More info: https://openssf.org/training/courses/
25+
26+
Could I use Dall-E and Dall-E-2 to generate images that would then be
27+
included in the course, to help students understand its concepts?
28+
I would *not* provide a general web API to generate new images, I'd just
29+
include the generated images.
30+
31+
I reviewed your policy here:
32+
https://labs.openai.com/policies/content-policy
33+
However, I couldn't figure out if this was allowed or not.
34+
35+
I would be *delighted* to give OpenAI credit if it's allowed.
36+
37+
Thanks!!
38+
39+
--- David A. Wheeler

‎openai/racecars.png

1.52 MB
Loading

‎openai/top-level-terms

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
OpenAI made the following statements when we created an account:
2+
3+
1. Keep your creations G-rated, and don't share images with photorealistic faces.
4+
2. DALL·E is for personal, non-commercial use. Sorry, no NFTs :)
5+
3. OpenAI owns images created by DALL·E. You retain rights to images you upload.
6+
4. We may use your data, including uploads, to improve models and enforce policies.

‎secure_software_development_fundamentals.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1032,6 +1032,9 @@ Many other design principles have been proposed, based on problems that have hap
10321032

10331033
A *race condition* happens when a system’s correct behavior depends on the sequence of events, but there is no control over that sequence. Race conditions generally involve one or more processes or threads accessing a shared resource, but this multiple access has not been properly controlled.
10341034

1035+
![A blue racecar and a red racecar racing to the finish line in front of a futuristic city](openai/racecars.png)<br>
1036+
*Racecars* generated by [OpenAI's Dall-E-2](https://openai.com/dall-e-2/)
1037+
10351038
If there is no control at all, that is a defect, and it might even be a vulnerability. Many programs, to be secure, have to do two things: (1) determine if a request is authorized, and (2) if it is, act on that request. If it is possible for an attacker to change the situation between steps 1 and 2, then the program could correctly determine that it is authorized, but then allow a different action that was *not* authorized. This kind of security mistake is so common that it has a name, a *time of check - time of use* (TOCTOU) race condition.
10361039

10371040
In many situations, the right way to counter TOCTOU race conditions is to implement and use APIs that both check the authorization and perform the action *simultaneously* (that is, they will not allow an attacker to change the situation between the check and the use). For example:

0 commit comments

Comments
 (0)