3 ms·

What do these companies do about browsers? If they can block at the network level, group policy to disable an app feature is moot. Put another way: if corporat

by hiatus 2y ago

What do these companies do about browsers? If they can block at the network level, group policy to disable an app feature is moot. Put another way: if corporate policy blocks this app but not access to OpenAI, they are not solving the underlying issue. If they already block OpenAI they don't need the application control.

miki123211 2y ago
> What do these companies do about browsers? Many things, browsers are pretty configurable via group policy. One possibility is to force browsers to go through a proxy that inspects all traffic, for example.
- hiatus 2y ago
  So these companies configure every application on the system individually to use a proxy? What about things like curl?
  - swiftcoder 2y ago
    In a sufficiently high-security environment, they just block all network access that doesn't go through the proxy. That's a fairly nuclear option, however, as it also blocks a lot of harmless traffic (Spotify, for example)
    - lolinder 2y ago
      Which, incidentally, would render this feature useless and harmless. It's just really hard to see the argument against the feature as anything other than an excuse for general anti-AI sentiments. Organizations that really care about this already have the tooling in place to stop all AI features in all products with just a few network-level rules. If they don't have that tooling, they're not taking it seriously and they're not going to start suddenly blocking iTerm2 because it added an optional AI feature.
      - swiftcoder 2y ago
        They don't, actually. Network blocking is all fine and dandy until someone adds a secure proxy into their software. Shit like this is exactly why enterprise software implements policy controls (as iTerm has just done).
  - wpm 2y ago
    More likely they configure the operating system to force network traffic through a certain hole, or force users to manually connect to full tunnel VPN to access work resources. Currently my employers inspect every network call made on my device, and while they do not block OpenAI, they do block us from running specific browsers that cannot have their built in “secure” DNS settings changed such that they won’t sidestep inspection. I get emails if I visit the Eicar test file website.
spenczar5 2y ago
Mandatory browser extensions are common, as are MITM proxies for all traffic.
- hiatus 2y ago
  What do these companies do about curl or telnet or SSH or any number of developer tools?
  - kstrauser 2y ago
    From experience, “we don’t talk about those”.
EasyMark 2y ago
I think people expect browsers to go outside the LAN, though? I don't expect a termainal like iTerm2 to be sending out network requests other than maybe to see if there's an update. I think people in IT, especially ones where security is core, like that sort of thing. That said they could courteously request it get turned off rather than freak out over it (it is free after all), but I think people don't like surprises out of staples like a terminal.
- lolinder 2y ago
  You're missing the point though: the only real argument I've seen for this being extracted altogether is a corporate environment where the existence of this feature would be enough to get the application blocked. OP is questioning why that would be a reasonable approach for an IT apartment to take—if they already block OpenAI then the feature won't do anything even if configured. If they don't already block it, then there are almost certainly people in their company using OpenAI with the browser. Network level blocking is easier and more effective, so why should iTerm2 have to go to contortions to remove an already opt-in feature that would be easily blocked by a network block?

by hiatus 2y ago

miki123211 2y ago

> What do these companies do about browsers? Many things, browsers are pretty configurable via group policy. One possibility is to force browsers to go through a proxy that inspects all traffic, for example.

hiatus 2y ago
So these companies configure every application on the system individually to use a proxy? What about things like curl?
- swiftcoder 2y ago
  In a sufficiently high-security environment, they just block all network access that doesn't go through the proxy. That's a fairly nuclear option, however, as it also blocks a lot of harmless traffic (Spotify, for example)
  - lolinder 2y ago
    Which, incidentally, would render this feature useless and harmless. It's just really hard to see the argument against the feature as anything other than an excuse for general anti-AI sentiments. Organizations that really care about this already have the tooling in place to stop all AI features in all products with just a few network-level rules. If they don't have that tooling, they're not taking it seriously and they're not going to start suddenly blocking iTerm2 because it added an optional AI feature.
    - swiftcoder 2y ago
      They don't, actually. Network blocking is all fine and dandy until someone adds a secure proxy into their software. Shit like this is exactly why enterprise software implements policy controls (as iTerm has just done).
- wpm 2y ago
  More likely they configure the operating system to force network traffic through a certain hole, or force users to manually connect to full tunnel VPN to access work resources. Currently my employers inspect every network call made on my device, and while they do not block OpenAI, they do block us from running specific browsers that cannot have their built in “secure” DNS settings changed such that they won’t sidestep inspection. I get emails if I visit the Eicar test file website.

spenczar5 2y ago

Mandatory browser extensions are common, as are MITM proxies for all traffic.

hiatus 2y ago
What do these companies do about curl or telnet or SSH or any number of developer tools?
- kstrauser 2y ago
  From experience, “we don’t talk about those”.

EasyMark 2y ago

I think people expect browsers to go outside the LAN, though? I don't expect a termainal like iTerm2 to be sending out network requests other than maybe to see if there's an update. I think people in IT, especially ones where security is core, like that sort of thing. That said they could courteously request it get turned off rather than freak out over it (it is free after all), but I think people don't like surprises out of staples like a terminal.

lolinder 2y ago
You're missing the point though: the only real argument I've seen for this being extracted altogether is a corporate environment where the existence of this feature would be enough to get the application blocked. OP is questioning why that would be a reasonable approach for an IT apartment to take—if they already block OpenAI then the feature won't do anything even if configured. If they don't already block it, then there are almost certainly people in their company using OpenAI with the browser. Network level blocking is easier and more effective, so why should iTerm2 have to go to contortions to remove an already opt-in feature that would be easily blocked by a network block?