7 ms·

It's not, actually, solely that. If you're using a product that does not make API calls externally with your data previously in a corporate environment that ha

It's not, actually, solely that. If you're using a product that does not make API calls externally with your data previously in a corporate environment that has very strict controls, and they add a feature that is part of the base install package, even if opt-in, that allows it to do that, and they do not have something like Group Policy hooks to forcibly disable it from on high, then they will block the product globally until the functionality is more contained to something their compliance systems can prevent, be it via a group policy hook or blocking the install at all. Companies take "we might make an external call with your data" very seriously, and regardless of how much you trust the external entity, adding that in is rightfully seen as a very serious concern in some environments.

throw10920 2y ago
This is not universal. I work in a company that uses many different products that (attempt to) make external API calls with extremely sensitive data, and none of these products are blocked from installation, because we block all their requests at the network level, instead. Yes, the corporate management is useful, but not critical, and the lack of it absolutely didn't justify the generated outrage.
- rincebrain 2y ago
  e: You changed this from "This is not true." to "This is not universal." in the time when I was writing this response, which is fine, but I wasn't claiming this is universally the case, I was claiming that in some environments, this is how the logic works. It's more or less the same outcome and rationale as when JetBrains had theirs in a "plugin" that you couldn't effectively block even if it was a noop because it required an API key. Sure, in an environment where external access is not necessary or can be easily allowlisted, that works fine. But on someone's interactive workstation, where they might need to access parts of the internet without getting explicit allowlisting of every web site, then it's a different set of tradeoffs, and not every company implements this the same way.
  - throw10920 2y ago
    From the perspective of "some corporate environments will block your software if it doesn't have this feature", then I suppose I can understand the frustration that users felt. I would argue that there's more nuance, but the feeling is reasonable - I would also be frustrated if a piece of software that I used and loved at work was in danger of being taken away because of the addition of a feature that I didn't want in the first place!
hiatus 2y ago
What do these companies do about browsers? If they can block at the network level, group policy to disable an app feature is moot. Put another way: if corporate policy blocks this app but not access to OpenAI, they are not solving the underlying issue. If they already block OpenAI they don't need the application control.
- miki123211 2y ago
  > What do these companies do about browsers? Many things, browsers are pretty configurable via group policy. One possibility is to force browsers to go through a proxy that inspects all traffic, for example.
  - hiatus 2y ago
    So these companies configure every application on the system individually to use a proxy? What about things like curl?
    - swiftcoder 2y ago
      In a sufficiently high-security environment, they just block all network access that doesn't go through the proxy. That's a fairly nuclear option, however, as it also blocks a lot of harmless traffic (Spotify, for example)
      - lolinder 2y ago
        Which, incidentally, would render this feature useless and harmless. It's just really hard to see the argument against the feature as anything other than an excuse for general anti-AI sentiments. Organizations that really care about this already have the tooling in place to stop all AI features in all products with just a few network-level rules. If they don't have that tooling, they're not taking it seriously and they're not going to start suddenly blocking iTerm2 because it added an optional AI feature.
        2y ago
fipar 2y ago
> Companies take "we might make an external call with your data" very seriously, and regardless of how much you trust the external entity, adding that in is rightfully seen as a very serious concern in some environments Please don't take this as an attack to you, but one would think that environments where this is a very serious concern would also be environments that either buy software, or buy support contracts with open source developers, to make sure that what they install is compliant with their concerns.
- OskarS 2y ago
  Totally! People in these kinds of environments have no leg to stand on criticizing a free and open source project. If you don't like it, don't use it, but CERTAINLY do not demand of the developers that they honor your requests when you don't contribute to development.
  - bunderbunder 2y ago
    Most employees in corporate environments do not get to set company policy. Most users of open source software do not have the skills necessary to modify said software. Complaining is the only recourse that most people have.
    - ForHackernews 2y ago
      They can take their fat corporate salaries and hire a therapist to listen to them complain. Leave the FLOSS maintainers alone.
- nerdponx 2y ago
  A lot of times the open-source software is used "unofficially", where IT/security turns a blind eye to it as long as it doesn't openly violate policies. And often the developer is not offering a support contract. They might even take umbrage at the idea of being bribed to make changes! A lot of open-source software usage in the workplace is the equivalent of bringing your own tools to a worksite, or bringing your own knife set to the kitchen. I obviously can't see the project's finances, but funding for tools like iTerm 2 can be heavily dependent on individual users acting as patrons, making monthly donations purely out of gratitude for bringing them joy and/or improving their personal work productivity.
codegladiator 2y ago
> Companies take "we might make an external call with your data" very seriously No, they want to be seen taking it seriously, so they say that they take it very seriously. But if you will actually audit their system you will find they do not in reality and it was just a negotiation tactic.
joshstrange 2y ago
This comment is aimed at the people who made this argument, not you specifically. This is a completely ridiculous strawman. If a corporation needs strict controls then they don't allow for auto-updated software without vetting. They could have asked for a policy to disable the integration but they didn't, instead those people screamed about how they were going to have to completely block iTerm which showed their incompetence. This was in beta for quite a while and none of these "serious IT people" cared so either they are asleep at the wheel (not vetting beta versions) or they allow for auto-updates to software they don't control, either way it screams incompetence to me. Also we are talking about a terminal here, a tool that can connect wherever the developer tells it to connect to. Are you telling me these companies lock down where a developer can SSH to but are too stupid to block traffic to OpenAI? Or they don't lock down where a developer can SSH and therefore don't talk to me about "strict controls". Make it make sense. It just doesn't. This argument never held any water for me.
- pseudalopex 2y ago
  Various people suggested or demanded various things for various reasons. Some described company controls. Some described company policies without controls. Some described their own strong feelings. Some had auto updated. Some had not. Some did not say. Some supported their companies' policies. Some stressed the policies were out of their control. Some did not say. Some asked how to make sure the integration was disabled. Some did ask for a setting an IT department could manage. Some demanded a plugin or separate build. Some said a plugin would work for them. Many things don't make sense if you assume everyone you disagree with are a collective.
  - joshstrange 2y ago
    I didn't assume they were a collective. I read through many of the comments on the GitLab issue as they were happening and there wasn't as single valid complaint. Not one. Zero. Zilch. It was opt in, full stop. That should have been the end of this aside from IT managers asking for a group policy or a was to disable the feature (in a nice way). Everyone complaining could either not update or move to a different tool and ask for a refund... oh wait... that's right, this was open source software. And people wonder why no one wants to maintain open source software. Just add this whole ordeal to the ever-growing pile of reasons why it's almost not worth doing. People are so entitled. My personal favorite were the people that said "If you remove this I'll start support you monetarily", which I assume 99% of those people were lying through their teeth based on the lack of spike in new donations to his patreon [0]. [0] https://graphtreon.com/creator/gnachman https://graphtreon.com/creator/gnachman
tzs 2y ago
iTerm is a terminal program that only runs on MacOS. Unless those very strict controls include either blocking at the network level accesses to IP addresses not on a pre-approved list or removing a large number of programs and libraries that are standard on MacOS the person using iTerm will have plenty of readily available ways to use external services with that data if they want to. Heck, the free version of ChatGPT can tell you how to access ChatGPT with curl if you don't know how [1]. I specifically asked about curl, but it would also work if I asked it to suggest a MacOS command like tool: "On MacOS what command line tools could I use to ask ChatGPT a question? Assume I have a ChatGPT API key". It suggests curl, httpie, and wget and shows how to use all of them. I updated the link below to include that too. [1] https://chatgpt.com/share/00d9de15-4e43-497f-a116-bfe3972471a9 https://chatgpt.com/share/00d9de15-4e43-497f-a116-bfe3972471...
kstrauser 2y ago
Block it with the same mechanisms you use to block web browsers from accessing the same content. If you do that already, you’re got. If you don’t, apparently it’s not that much of an issue.
hnlmorg 2y ago
Having worked in such environments one of two things happen: 1. Developers are forced to use Windows and given very little CLI access. And they certainly wouldn’t be using iTerm since it’s macOS only. 2. Developers are given a Windows corporate device as well as a MacBook Pro. The MBP doesn’t have access to any corporate systems 3. Developers can access corporate systems on MBP via jamf or InTune. The corporate side of the business accepts the risk that developers can access external (read: non-vetted) services but the business has access to all internet traffic logs from your device (usually pushed into some kind of security package that monitors for suspicious traffic) plus the ability to remote wipe it. So there is a degree of trust given to the developers. Those that are stuck with option 1 are usually the unhappiest and least productive. So it’s not something most businesses like to entertain unless senior management is very corporate and the business is considered high risk.
mr-karan 2y ago
So, just because some corporate cannot keep up with their IT compliance team with new additions to existing tools in their stack (which is honestly a tedious job), should the OSS stop experimenting and shipping new 'optional' features? There are many developers who use iTerm2 outside of a corporate environment too. I, for one, developed clx[1], which is similar in nature to what iTerm's OpenAI integration is. I am happy to have this built right into my terminal. And the code is open source as well, allowing anyone to audit what actual external API calls are being made. [1]: https://github.com/mr-karan/clx https://github.com/mr-karan/clx
ForHackernews 2y ago
What's good for the goose is good for the gander. None of these companies so much as bat an eye when applying the most sweeping, invasive data collection against their users. They should be equally thrilled to have spyware on their LAN that may enable more relevant workplace experiences for their employees.

throw10920 2y ago

This is not universal. I work in a company that uses many different products that (attempt to) make external API calls with extremely sensitive data, and none of these products are blocked from installation, because we block all their requests at the network level, instead. Yes, the corporate management is useful, but not critical, and the lack of it absolutely didn't justify the generated outrage.

rincebrain 2y ago
e: You changed this from "This is not true." to "This is not universal." in the time when I was writing this response, which is fine, but I wasn't claiming this is universally the case, I was claiming that in some environments, this is how the logic works. It's more or less the same outcome and rationale as when JetBrains had theirs in a "plugin" that you couldn't effectively block even if it was a noop because it required an API key. Sure, in an environment where external access is not necessary or can be easily allowlisted, that works fine. But on someone's interactive workstation, where they might need to access parts of the internet without getting explicit allowlisting of every web site, then it's a different set of tradeoffs, and not every company implements this the same way.
- throw10920 2y ago
  From the perspective of "some corporate environments will block your software if it doesn't have this feature", then I suppose I can understand the frustration that users felt. I would argue that there's more nuance, but the feeling is reasonable - I would also be frustrated if a piece of software that I used and loved at work was in danger of being taken away because of the addition of a feature that I didn't want in the first place!

hiatus 2y ago

What do these companies do about browsers? If they can block at the network level, group policy to disable an app feature is moot. Put another way: if corporate policy blocks this app but not access to OpenAI, they are not solving the underlying issue. If they already block OpenAI they don't need the application control.

miki123211 2y ago
> What do these companies do about browsers? Many things, browsers are pretty configurable via group policy. One possibility is to force browsers to go through a proxy that inspects all traffic, for example.
- hiatus 2y ago
  So these companies configure every application on the system individually to use a proxy? What about things like curl?
  - swiftcoder 2y ago
    In a sufficiently high-security environment, they just block all network access that doesn't go through the proxy. That's a fairly nuclear option, however, as it also blocks a lot of harmless traffic (Spotify, for example)
    - lolinder 2y ago
      Which, incidentally, would render this feature useless and harmless. It's just really hard to see the argument against the feature as anything other than an excuse for general anti-AI sentiments. Organizations that really care about this already have the tooling in place to stop all AI features in all products with just a few network-level rules. If they don't have that tooling, they're not taking it seriously and they're not going to start suddenly blocking iTerm2 because it added an optional AI feature.
      - 2y ago

fipar 2y ago

> Companies take "we might make an external call with your data" very seriously, and regardless of how much you trust the external entity, adding that in is rightfully seen as a very serious concern in some environments Please don't take this as an attack to you, but one would think that environments where this is a very serious concern would also be environments that either buy software, or buy support contracts with open source developers, to make sure that what they install is compliant with their concerns.

OskarS 2y ago
Totally! People in these kinds of environments have no leg to stand on criticizing a free and open source project. If you don't like it, don't use it, but CERTAINLY do not demand of the developers that they honor your requests when you don't contribute to development.
- bunderbunder 2y ago
  Most employees in corporate environments do not get to set company policy. Most users of open source software do not have the skills necessary to modify said software. Complaining is the only recourse that most people have.
  - ForHackernews 2y ago
    They can take their fat corporate salaries and hire a therapist to listen to them complain. Leave the FLOSS maintainers alone.
nerdponx 2y ago
A lot of times the open-source software is used "unofficially", where IT/security turns a blind eye to it as long as it doesn't openly violate policies. And often the developer is not offering a support contract. They might even take umbrage at the idea of being bribed to make changes! A lot of open-source software usage in the workplace is the equivalent of bringing your own tools to a worksite, or bringing your own knife set to the kitchen. I obviously can't see the project's finances, but funding for tools like iTerm 2 can be heavily dependent on individual users acting as patrons, making monthly donations purely out of gratitude for bringing them joy and/or improving their personal work productivity.

codegladiator 2y ago

> Companies take "we might make an external call with your data" very seriously No, they want to be seen taking it seriously, so they say that they take it very seriously. But if you will actually audit their system you will find they do not in reality and it was just a negotiation tactic.

joshstrange 2y ago

This comment is aimed at the people who made this argument, not you specifically. This is a completely ridiculous strawman. If a corporation needs strict controls then they don't allow for auto-updated software without vetting. They could have asked for a policy to disable the integration but they didn't, instead those people screamed about how they were going to have to completely block iTerm which showed their incompetence. This was in beta for quite a while and none of these "serious IT people" cared so either they are asleep at the wheel (not vetting beta versions) or they allow for auto-updates to software they don't control, either way it screams incompetence to me. Also we are talking about a terminal here, a tool that can connect wherever the developer tells it to connect to. Are you telling me these companies lock down where a developer can SSH to but are too stupid to block traffic to OpenAI? Or they don't lock down where a developer can SSH and therefore don't talk to me about "strict controls". Make it make sense. It just doesn't. This argument never held any water for me.

pseudalopex 2y ago
Various people suggested or demanded various things for various reasons. Some described company controls. Some described company policies without controls. Some described their own strong feelings. Some had auto updated. Some had not. Some did not say. Some supported their companies' policies. Some stressed the policies were out of their control. Some did not say. Some asked how to make sure the integration was disabled. Some did ask for a setting an IT department could manage. Some demanded a plugin or separate build. Some said a plugin would work for them. Many things don't make sense if you assume everyone you disagree with are a collective.
- joshstrange 2y ago
  I didn't assume they were a collective. I read through many of the comments on the GitLab issue as they were happening and there wasn't as single valid complaint. Not one. Zero. Zilch. It was opt in, full stop. That should have been the end of this aside from IT managers asking for a group policy or a was to disable the feature (in a nice way). Everyone complaining could either not update or move to a different tool and ask for a refund... oh wait... that's right, this was open source software. And people wonder why no one wants to maintain open source software. Just add this whole ordeal to the ever-growing pile of reasons why it's almost not worth doing. People are so entitled. My personal favorite were the people that said "If you remove this I'll start support you monetarily", which I assume 99% of those people were lying through their teeth based on the lack of spike in new donations to his patreon [0]. [0] https://graphtreon.com/creator/gnachman https://graphtreon.com/creator/gnachman

tzs 2y ago

iTerm is a terminal program that only runs on MacOS. Unless those very strict controls include either blocking at the network level accesses to IP addresses not on a pre-approved list or removing a large number of programs and libraries that are standard on MacOS the person using iTerm will have plenty of readily available ways to use external services with that data if they want to. Heck, the free version of ChatGPT can tell you how to access ChatGPT with curl if you don't know how [1]. I specifically asked about curl, but it would also work if I asked it to suggest a MacOS command like tool: "On MacOS what command line tools could I use to ask ChatGPT a question? Assume I have a ChatGPT API key". It suggests curl, httpie, and wget and shows how to use all of them. I updated the link below to include that too. [1] https://chatgpt.com/share/00d9de15-4e43-497f-a116-bfe3972471a9 https://chatgpt.com/share/00d9de15-4e43-497f-a116-bfe3972471...

kstrauser 2y ago

Block it with the same mechanisms you use to block web browsers from accessing the same content. If you do that already, you’re got. If you don’t, apparently it’s not that much of an issue.

hnlmorg 2y ago

Having worked in such environments one of two things happen: 1. Developers are forced to use Windows and given very little CLI access. And they certainly wouldn’t be using iTerm since it’s macOS only. 2. Developers are given a Windows corporate device as well as a MacBook Pro. The MBP doesn’t have access to any corporate systems 3. Developers can access corporate systems on MBP via jamf or InTune. The corporate side of the business accepts the risk that developers can access external (read: non-vetted) services but the business has access to all internet traffic logs from your device (usually pushed into some kind of security package that monitors for suspicious traffic) plus the ability to remote wipe it. So there is a degree of trust given to the developers. Those that are stuck with option 1 are usually the unhappiest and least productive. So it’s not something most businesses like to entertain unless senior management is very corporate and the business is considered high risk.

mr-karan 2y ago

So, just because some corporate cannot keep up with their IT compliance team with new additions to existing tools in their stack (which is honestly a tedious job), should the OSS stop experimenting and shipping new 'optional' features? There are many developers who use iTerm2 outside of a corporate environment too. I, for one, developed clx[1], which is similar in nature to what iTerm's OpenAI integration is. I am happy to have this built right into my terminal. And the code is open source as well, allowing anyone to audit what actual external API calls are being made. [1]: https://github.com/mr-karan/clx https://github.com/mr-karan/clx

ForHackernews 2y ago

What's good for the goose is good for the gander. None of these companies so much as bat an eye when applying the most sweeping, invasive data collection against their users. They should be equally thrilled to have spyware on their LAN that may enable more relevant workplace experiences for their employees.