8 ms·

This is the issue with a tool so powerful, you can't just tell people not to use it, or to use it responsibly. Because there's too much incentive for them to us

This is the issue with a tool so powerful, you can't just tell people not to use it, or to use it responsibly. Because there's too much incentive for them to use it. If it saves hours of a persons' workday, and they're not seeing any of the harm caused from data leakage, there's no incentive for them to not use it. Which is why a private option is so critical. To not fight against human nature, means providing an ability to use the tool in a safe way.

JohnFen 4y ago
There's a dev here who is using ChatGPT extensively in his work. The rest of the team is just waiting for him to get caught and fired. Sharing company data with unapproved external entities is very definitely a firing offense.
- yathrowaway01 4y ago
  Glad I work for a company where the CEO pays for everyones ChatGPT Plus for the devs. If you think your code is special then you're wrong.
  - strus 4y ago
    > If you think your code is special then you're wrong Your code is not special, but customers data may be. Also, some companies needs to comply to various certifications, and proven leak of source code that was put into some third party tool may be a reason to revoke such certification. Which can cause a serious financial harm to a given company, as it can lead to ex. losing government clients. This is just the tip of the iceberg.
  - helsinki 4y ago
    Your code might not be special, but I think plenty of hedge funds and prop trading firms beg to differ.
  - croes 4y ago
    You are still transferring your business data to an external entity, but on top of it you pay for it. And if you think that there is no special code then you're wrong.
    - yathrowaway01 4y ago
      If you think random snippets of code are special you really don't understand the business you're writing code for. So no, your code is not special, and pasting code snippets is not transferring business data.
      - jabradoodle 4y ago
        What do you know about the code written by the people you are replying to? Lots of code expresses buisness strategy that is a competitive advantage/ sensitive. My org has done a risk assessment and accepted the risk of using such tools; arguing there is no risk is short sighted.
      - JohnFen 4y ago
        > pasting code snippets is not transferring business data. It literally is exactly that. You don't think the code a business creates is "business data"?
        yathrowaway01 4y ago
        [dead]
      - quickthrower2 4y ago
        You forgot IANAL
  - JohnFen 4y ago
    That entirely depends on the code. It's not that the code is special, it's that the code can reveal things that are competitive advantages (future plans, etc.)
  - msm_ 4y ago
    But you created a throwaway account specifically to reply in this thread? Unless your company really has nothing to hide, it's easy to accidentally dump a company secret or an API key in a chat session. Of course if everyone is aware of this and constantly careful then you may be OK.
    - yathrowaway01 4y ago
      That's because accounts get shadow banned all the time when people get upset when you point out hard truths. If you're copy pasting API keys or such into ANYTHING, you probably shouldn't be a programmer to begin with. It's like people who use root account key/secret credentials in their codebase. It's not AWSs fault you got a large bill or got hacked, its because you're dumb.
      - reportgunner 4y ago
        Nice so avoiding getting shadowbanned on hackernews is fine but avoiding getting sued is petty ?
      - bcrosby95 4y ago
        I regularly say shit that pisses people off here and I have never been shadow banned. It sounds like your "hard truths" are something other than just "hard truths", and/or you have a persecution complex.
        yathrowaway01 4y ago
        Your Karma is over 7000, if you get downvoted your stuff is still visible.
        rurp 4y ago
        Getting downvoted to gray isn't a "shadow ban" at all. It is however a signal that others didn't find your comment worthwhile.
        bolanyo 4y ago
  - krono 4y ago
    If the contract says the code is special, then the code is special.
  - kristianp 4y ago
    Does chatgpt plus collect data for training, or does it have more privacy than the free offering?
    - kristianp 4y ago
      Replying to myself, it seems your data is still used, unless you fill in a google form to opt out: https://help.openai.com/en/articles/6950777-chatgpt-plus https://help.openai.com/en/articles/6950777-chatgpt-plus
      - pama 4y ago
        This Google form requires an organization ID so may not apply to personal GPT+ accounts.
        ghotli 4y ago
        Mine is personal and I just filled out this form with the ID from the docs. Easy, worked fine. Also thanks to the grandparent comment for surfacing this!
      - mwhitehead867 4y ago
        ChatGPT & DALL-E (non-API products) are opt-out while their API is opt-in https://help.openai.com/en/articles/7039943-data-usage-for-consumer-services-faq https://help.openai.com/en/articles/7039943-data-usage-for-c...
  - roflyear 4y ago
    Code isn't special but what you're working on can be and also it's not your decision if you're not the shareholder.
  - heavyset_go 4y ago
    My code is "special" in the fact that the act of sharing it can carry civil and criminal liabilities for myself, essentially threatening my well-being and freedom. Not my place legally or ethically to share code with 3rd parties that I've been paid to read and write.
- arcticfox 4y ago
  If they're more productive by doing it, I think it's an equal chance said dev gets promoted.
  - croes 4y ago
    Why? Uploading code to ChatGPT can be done by trainees.
    - sebzim4500 4y ago
      Yeah, but the code coming out of ChatGPT is generally not in a state that you want to commit straight into you repo. Making adjustments (and writing the original prompt) is where your expertise comes in.
      - reportgunner 4y ago
        You can just submit the trash code and let a senior fix it for you in code review.
  - JohnFen 4y ago
    He's not more productive, but even if he were, it wouldn't affect his getting fired. Productivity isn't everything.
- mym1990 4y ago
  If you really care about your company's security, you should report it, otherwise you are just complicit.
  - thomashop 4y ago
    Why not talk to the employee first?
    - mym1990 4y ago
      This could be valid...but with something as powerful as ChatGPT, if it is providing huge benefits for employee productivity, they are unlikely to dump it based off a co-worker's suggestion. Also, unless managing security is within your roles and responsibilities, this approach would likely turn messy from an interpersonal aspect. Lastly, the security issue has already happened, so if this is truly a security concern, the security team should know that (a) something is already out there (b) this could be a widespread problem in the future. FWIW I don't think the employee should be fired for this or anything, if anything a company could embrace these new technological advances and provide training on using ChatGPT in a more secure manner(ie don't paste your customer's PII into a prompt, etc...).
      - JohnFen 4y ago
        > if it is providing huge benefits for employee productivity With this particular employee, using chatGPT has not increased his productivity or the quality of his work by any noticeable degree. > I don't think the employee should be fired for this or anything The problem isn't using the technology. The problem is sharing confidential information with an unapproved entity. That is specifically and clearly spelled out as a firing offense, for pretty obvious reasons. Even if some people feel that it's an overly tight policy, it's a the stated policy and the company has every right to put and enforce whatever rules it wishes about the use of its own data.
  - JohnFen 4y ago
    I agree.
ghaff 4y ago
1.) It's not at all clear it's nearly as powerful as you think. Certainly in my domain--writing about various topics--it's not. 2.) Of course, you can tell people not to use it. Unlike people at SV companies apparently, people in government and government contractors accept restrictions like not having phones in secure labs all the time. Start firing or even prosecuting people and people will discover very quickly they don't really need some tool. And, yes, private versions of this sort of thing helps a lot.
raincole 4y ago
> you can't just tell people not to use it Uh, why can't you tell people not to use it...? If security is that important for your company, of course you can tell your employees which tools to use. A fun fact: in many areas of TSMC, smart phones are banned. No one says "you can't just tell people not to use smart phones."
- q845712 4y ago
  https://www.bleepingcomputer.com/news/technology/fitness-tracking-app-accidentally-exposed-military-bases/ https://www.bleepingcomputer.com/news/technology/fitness-tra...
- wil421 4y ago
  That’s very common in a lot of secure places. There are tons of government contractors who have to put smartphones away due to the cameras on them. Not to mention the more secure government places.
- KirillPanov 4y ago
  > in many areas of TSMC, smart phones are banned This does not surprise me at all. What I want to know is how they enforce it. Unless they have something better than "fear of somebody seeing you using the smartphone", it isn't getting enforced. If they do have something better I want to know what.
  - raincole 4y ago
    Metal detector. No, I'm not joking. One of my high-school classmates works as R&D there. They ask you to pass through a metal detector gate, take away your phone if found, then give your a company phone for emergency call only. It's that strict (at least for R&D. Probably not for management and others).
  - bob1029 4y ago
    At Samsung, you typically walk through multiple sets of metal detectors and security before you can actually get into the fab. Anyone working in an office area can have a phone but they do some... stuff to it.

JohnFen 4y ago

There's a dev here who is using ChatGPT extensively in his work. The rest of the team is just waiting for him to get caught and fired. Sharing company data with unapproved external entities is very definitely a firing offense.

yathrowaway01 4y ago
Glad I work for a company where the CEO pays for everyones ChatGPT Plus for the devs. If you think your code is special then you're wrong.
- strus 4y ago
  > If you think your code is special then you're wrong Your code is not special, but customers data may be. Also, some companies needs to comply to various certifications, and proven leak of source code that was put into some third party tool may be a reason to revoke such certification. Which can cause a serious financial harm to a given company, as it can lead to ex. losing government clients. This is just the tip of the iceberg.
- helsinki 4y ago
  Your code might not be special, but I think plenty of hedge funds and prop trading firms beg to differ.
- croes 4y ago
  You are still transferring your business data to an external entity, but on top of it you pay for it. And if you think that there is no special code then you're wrong.
  - yathrowaway01 4y ago
    If you think random snippets of code are special you really don't understand the business you're writing code for. So no, your code is not special, and pasting code snippets is not transferring business data.
    - jabradoodle 4y ago
      What do you know about the code written by the people you are replying to? Lots of code expresses buisness strategy that is a competitive advantage/ sensitive. My org has done a risk assessment and accepted the risk of using such tools; arguing there is no risk is short sighted.
    - JohnFen 4y ago
      > pasting code snippets is not transferring business data. It literally is exactly that. You don't think the code a business creates is "business data"?
      - yathrowaway01 4y ago
        [dead]
    - quickthrower2 4y ago
      You forgot IANAL
- JohnFen 4y ago
  That entirely depends on the code. It's not that the code is special, it's that the code can reveal things that are competitive advantages (future plans, etc.)
- msm_ 4y ago
  But you created a throwaway account specifically to reply in this thread? Unless your company really has nothing to hide, it's easy to accidentally dump a company secret or an API key in a chat session. Of course if everyone is aware of this and constantly careful then you may be OK.
  - yathrowaway01 4y ago
    That's because accounts get shadow banned all the time when people get upset when you point out hard truths. If you're copy pasting API keys or such into ANYTHING, you probably shouldn't be a programmer to begin with. It's like people who use root account key/secret credentials in their codebase. It's not AWSs fault you got a large bill or got hacked, its because you're dumb.
    - reportgunner 4y ago
      Nice so avoiding getting shadowbanned on hackernews is fine but avoiding getting sued is petty ?
    - bcrosby95 4y ago
      I regularly say shit that pisses people off here and I have never been shadow banned. It sounds like your "hard truths" are something other than just "hard truths", and/or you have a persecution complex.
      - yathrowaway01 4y ago
        Your Karma is over 7000, if you get downvoted your stuff is still visible.
        rurp 4y ago
        Getting downvoted to gray isn't a "shadow ban" at all. It is however a signal that others didn't find your comment worthwhile.
        bolanyo 4y ago
- krono 4y ago
  If the contract says the code is special, then the code is special.
- kristianp 4y ago
  Does chatgpt plus collect data for training, or does it have more privacy than the free offering?
  - kristianp 4y ago
    Replying to myself, it seems your data is still used, unless you fill in a google form to opt out: https://help.openai.com/en/articles/6950777-chatgpt-plus https://help.openai.com/en/articles/6950777-chatgpt-plus
    - pama 4y ago
      This Google form requires an organization ID so may not apply to personal GPT+ accounts.
      - ghotli 4y ago
        Mine is personal and I just filled out this form with the ID from the docs. Easy, worked fine. Also thanks to the grandparent comment for surfacing this!
    - mwhitehead867 4y ago
      ChatGPT & DALL-E (non-API products) are opt-out while their API is opt-in https://help.openai.com/en/articles/7039943-data-usage-for-consumer-services-faq https://help.openai.com/en/articles/7039943-data-usage-for-c...
- roflyear 4y ago
  Code isn't special but what you're working on can be and also it's not your decision if you're not the shareholder.
- heavyset_go 4y ago
  My code is "special" in the fact that the act of sharing it can carry civil and criminal liabilities for myself, essentially threatening my well-being and freedom. Not my place legally or ethically to share code with 3rd parties that I've been paid to read and write.
arcticfox 4y ago
If they're more productive by doing it, I think it's an equal chance said dev gets promoted.
- croes 4y ago
  Why? Uploading code to ChatGPT can be done by trainees.
  - sebzim4500 4y ago
    Yeah, but the code coming out of ChatGPT is generally not in a state that you want to commit straight into you repo. Making adjustments (and writing the original prompt) is where your expertise comes in.
    - reportgunner 4y ago
      You can just submit the trash code and let a senior fix it for you in code review.
- JohnFen 4y ago
  He's not more productive, but even if he were, it wouldn't affect his getting fired. Productivity isn't everything.
mym1990 4y ago
If you really care about your company's security, you should report it, otherwise you are just complicit.
- thomashop 4y ago
  Why not talk to the employee first?
  - mym1990 4y ago
    This could be valid...but with something as powerful as ChatGPT, if it is providing huge benefits for employee productivity, they are unlikely to dump it based off a co-worker's suggestion. Also, unless managing security is within your roles and responsibilities, this approach would likely turn messy from an interpersonal aspect. Lastly, the security issue has already happened, so if this is truly a security concern, the security team should know that (a) something is already out there (b) this could be a widespread problem in the future. FWIW I don't think the employee should be fired for this or anything, if anything a company could embrace these new technological advances and provide training on using ChatGPT in a more secure manner(ie don't paste your customer's PII into a prompt, etc...).
    - JohnFen 4y ago
      > if it is providing huge benefits for employee productivity With this particular employee, using chatGPT has not increased his productivity or the quality of his work by any noticeable degree. > I don't think the employee should be fired for this or anything The problem isn't using the technology. The problem is sharing confidential information with an unapproved entity. That is specifically and clearly spelled out as a firing offense, for pretty obvious reasons. Even if some people feel that it's an overly tight policy, it's a the stated policy and the company has every right to put and enforce whatever rules it wishes about the use of its own data.
- JohnFen 4y ago
  I agree.

ghaff 4y ago

1.) It's not at all clear it's nearly as powerful as you think. Certainly in my domain--writing about various topics--it's not. 2.) Of course, you can tell people not to use it. Unlike people at SV companies apparently, people in government and government contractors accept restrictions like not having phones in secure labs all the time. Start firing or even prosecuting people and people will discover very quickly they don't really need some tool. And, yes, private versions of this sort of thing helps a lot.

raincole 4y ago

> you can't just tell people not to use it Uh, why can't you tell people not to use it...? If security is that important for your company, of course you can tell your employees which tools to use. A fun fact: in many areas of TSMC, smart phones are banned. No one says "you can't just tell people not to use smart phones."

q845712 4y ago
https://www.bleepingcomputer.com/news/technology/fitness-tracking-app-accidentally-exposed-military-bases/ https://www.bleepingcomputer.com/news/technology/fitness-tra...
wil421 4y ago
That’s very common in a lot of secure places. There are tons of government contractors who have to put smartphones away due to the cameras on them. Not to mention the more secure government places.
KirillPanov 4y ago
> in many areas of TSMC, smart phones are banned This does not surprise me at all. What I want to know is how they enforce it. Unless they have something better than "fear of somebody seeing you using the smartphone", it isn't getting enforced. If they do have something better I want to know what.
- raincole 4y ago
  Metal detector. No, I'm not joking. One of my high-school classmates works as R&D there. They ask you to pass through a metal detector gate, take away your phone if found, then give your a company phone for emergency call only. It's that strict (at least for R&D. Probably not for management and others).
- bob1029 4y ago
  At Samsung, you typically walk through multiple sets of metal detectors and security before you can actually get into the fab. Anyone working in an office area can have a phone but they do some... stuff to it.