3 ms·

I'd suggest everyone go read the issue thread (https://gitlab.com/gnachman/iterm2/-/issues/11470 https://gitlab.com/gnachman/iterm2/-/issues/11470) before comme

I'd suggest everyone go read the issue thread (https://gitlab.com/gnachman/iterm2/-/issues/11470 https://gitlab.com/gnachman/iterm2/-/issues/11470) before commenting. It seems abundantly clear that people are being overly negative about a feature that realistically has no security concerns (even as originally developed). Many commenters did not even know how the feature worked (assumed all keystrokes were being sent by default, etc...) One outright said that the feature should be removed because the developer must "stand against OpenAI and the whole "AI" industry." To me this just seems like a lot of people whining and trying to inject politics and unfounded safety concerns into a good implementation of something that many people like. This is an opt-in feature. It has a separate panel to even interact with it. And you need to provide a valid openai API key to use it.

TheCoreh 2y ago
> I don't care if there's a buried flag that enables or disables this behaviour. I want a binary that doesn't have this capability in it at all. That's a rather absurd way of approaching the threat model of data exfiltration on a terminal app. By its very definition a terminal needs the ability to spawn unsandboxed processes and send/receive input from/to them, including processes that have network access. Even if the binary doesn't contain specific logic to do this it could invoke curl, or a variety of other binaries that do, either on purpose or accidentally. In addition, it links against AppKit, which includes NSURLRequest. Is that off-limits too? If one's this allergic to OpenAI, that even an opt-in feature is a concern, they're better off using a firewall like Little Snitch, or blocking it at the DNS level. Additionally, if you don't trust the developer with this, why would you trust a binary from them without this feature?
- bangaladore 2y ago
  Agreed. This issue thread makes it apparent why many open source developers give up.

TheCoreh 2y ago

> I don't care if there's a buried flag that enables or disables this behaviour. I want a binary that doesn't have this capability in it at all. That's a rather absurd way of approaching the threat model of data exfiltration on a terminal app. By its very definition a terminal needs the ability to spawn unsandboxed processes and send/receive input from/to them, including processes that have network access. Even if the binary doesn't contain specific logic to do this it could invoke curl, or a variety of other binaries that do, either on purpose or accidentally. In addition, it links against AppKit, which includes NSURLRequest. Is that off-limits too? If one's this allergic to OpenAI, that even an opt-in feature is a concern, they're better off using a firewall like Little Snitch, or blocking it at the DNS level. Additionally, if you don't trust the developer with this, why would you trust a binary from them without this feature?

bangaladore 2y ago
Agreed. This issue thread makes it apparent why many open source developers give up.