3 ms·
I'd like to know how these kinds of tools (Copilot included) avoid reading users' secret tokens and passwords. But knowing how we programmers work and how we t
by raincole 3y ago
I'd like to know how these kinds of tools (Copilot included) avoid reading users' secret tokens and passwords.
But knowing how we programmers work and how we treat security collectively, I guess I've already had the answer.
- still_grokking 3y agoEverything you feed into the AI gets send to Microsoft (OpenAI), a premium partner of the NSA since day one.
- kesor 3y agoIf you want to have your "private model" running just for you, you can use Azure OpenAI ... but yeah, like @still_grokking said, everything you do eventually gets uploaded to Microsoft. With this specific project, it is running on your local host, so you can sanitize the data before allowing ChatGPT queries to suck it into the "cloud". Generally speaking, you should not have secrets and tokens in your code in the first place. This specific ChatGPT plugin respects your .gitignore files (unlike CoPilot?). So if you do have some tokens in .env.secrets, but the file is ignored, it wouldn't list that for ChatGPT to read. But you shouldn't hold tokens in your project in the first place, those belong in the running environment, not in the code.
- madamelic 3y agoNot put them in plain-text :shrug: I wrote a small utility to do this (https://www.npmjs.com/package/@qnzl/lockbox https://www.npmjs.com/package/@qnzl/lockbox) and it behaves similar to `pass` by using gpg encryption. I wrote it because I was doing a lot of programming streaming and I kept exposing secrets. So rather than having a .profile that is: GITHUB_TOKEN="steal this" It's GITHUB_TOKEN=$(lockbox product/dev/githubToken) Then you `source` it and your secrets are in your environment without putting them into plain-text.