4 ms·
You're wildly mistaken about what's going on - the feature was already opt-in. The feature literally didn't work unless you went into settings and manually ente
by throw10920 2y ago
You're wildly mistaken about what's going on - the feature was already opt-in. The feature literally didn't work unless you went into settings and manually entered an OpenAI key. That is literally the definition of "opt-in".
- ceejayoz 2y agoThe linked release notes appear to be appropriate tweaks; a blockable plugin and needing admin rights to enable are important adjustments for corporate environments. Just because I opt-in doesn't mean my company wants me to opt-in on their behalf.
- throw10920 2y agoYes, these are useful improvements for corporate management of software - but that's not what most of the outage was about. Also, if there wasn't a firewall that would have blocked iTerm from hitting the OpenAI APIs, then there wouldn't have been anything preventing users from just directly accessing it.
- kgeist 2y agoNo one stops me from opening chatgpt.com in the browser and pasting corporate stuff there. Could'nt admins just ban all access to chatgpt.com and openai.com when accessed from the corporate network? That would be a solution for all software, not just iTerm.
- ceejayoz 2y agoThey should, but defense-in-depth is a thing.
- throw10920 2y agoWhat's the threat model?
- ceejayoz 2y agoA few off the top of my head: iTerm starts sending the calls through a proxy for billing/analytics; iTerm adds a model selector that hits other APIs in an update.
- mb389 2y agochatgpt in your browser doesnt have access to your entire file system
- hiatus 2y agoIf your browser has access to your entire file system, chatgpt can have that access, too.
- swiftcoder 2y agoThere's a reason various major browser vendors have refused to implement the FileSystem APIs...
- deleted 2y ago[deleted]
- swiftcoder 2y agoEnabling the feature was opt-in, yes, installing the feature was not (and has been made opt-in with this new update). Apparently a lot of folks don't regard this as an critical distinction, but as someone working in a regulated industry, there is a distinction here that is worth understanding.
- throw10920 2y agoIf your industry doesn't block stuff like this at the network level, then the "regulation" is a joke.
- swiftcoder 2y agoBlocking at the network level is of course necessary, but it's hardly sufficient. If tomorrow your app starts directing traffic through a secure proxy, we'd have no reliable way to detect that - this is why software designed to operate in high-security environments needs built-in policy controls.
- throw10920 2y ago> If tomorrow your app starts directing traffic through a secure proxy ...then the app's developers have already shown themselves to be malicious and they wouldn't respect a feature toggle in the first place.
- swiftcoder 2y agoAnd they can demonstrate the opposite by implementing policy controls - as they have done here
- kstrauser 2y agoI was the CISO at a HIPAA-covered healthtech company and the opt-in feature as it was wouldn’t have bothered me at all. It adds nothing to the threat model that you don’t already have with curl.