It was a hate bandwagon born out of sheer ignorance with no actual problem behind it.
If you're using a product that does not make API calls externally with your data previously in a corporate environment that has very strict controls, and they add a feature that is part of the base install package, even if opt-in, that allows it to do that, and they do not have something like Group Policy hooks to forcibly disable it from on high, then they will block the product globally until the functionality is more contained to something their compliance systems can prevent, be it via a group policy hook or blocking the install at all.
Companies take "we might make an external call with your data" very seriously, and regardless of how much you trust the external entity, adding that in is rightfully seen as a very serious concern in some environments.
I work in a company that uses many different products that (attempt to) make external API calls with extremely sensitive data, and none of these products are blocked from installation, because we block all their requests at the network level, instead.
Yes, the corporate management is useful, but not critical, and the lack of it absolutely didn't justify the generated outrage.
Sure, in an environment where external access is not necessary or can be easily allowlisted, that works fine.
But on someone's interactive workstation, where they might need to access parts of the internet without getting explicit allowlisting of every web site, then it's a different set of tradeoffs, and not every company implements this the same way.
I would argue that there's more nuance, but the feeling is reasonable - I would also be frustrated if a piece of software that I used and loved at work was in danger of being taken away because of the addition of a feature that I didn't want in the first place!
Put another way: if corporate policy blocks this app but not access to OpenAI, they are not solving the underlying issue. If they already block OpenAI they don't need the application control.
Many things, browsers are pretty configurable via group policy. One possibility is to force browsers to go through a proxy that inspects all traffic, for example.
It's just really hard to see the argument against the feature as anything other than an excuse for general anti-AI sentiments. Organizations that really care about this already have the tooling in place to stop all AI features in all products with just a few network-level rules. If they don't have that tooling, they're not taking it seriously and they're not going to start suddenly blocking iTerm2 because it added an optional AI feature.
Currently my employers inspect every network call made on my device, and while they do not block OpenAI, they do block us from running specific browsers that cannot have their built in “secure” DNS settings changed such that they won’t sidestep inspection.
I get emails if I visit the Eicar test file website.
Network level blocking is easier and more effective, so why should iTerm2 have to go to contortions to remove an already opt-in feature that would be easily blocked by a network block?
Please don't take this as an attack to you, but one would think that environments where this is a very serious concern would also be environments that either buy software, or buy support contracts with open source developers, to make sure that what they install is compliant with their concerns.
Most users of open source software do not have the skills necessary to modify said software.
Complaining is the only recourse that most people have.
And often the developer is not offering a support contract. They might even take umbrage at the idea of being bribed to make changes!
A lot of open-source software usage in the workplace is the equivalent of bringing your own tools to a worksite, or bringing your own knife set to the kitchen. I obviously can't see the project's finances, but funding for tools like iTerm 2 can be heavily dependent on individual users acting as patrons, making monthly donations purely out of gratitude for bringing them joy and/or improving their personal work productivity.
It's like when a company buys a contract with an enterprise Linux distribution: the entity offering the contract didn't author the full stack (though I'd guess they have at least some kernel contributors on staff) but they can still support it in a way that keeps the compliance department of the buying company happy.
Also, your kitchen knife set example is very relevant because, from personal experience, I know this happens but I also know problems (including accidents) resulting from using a personal knife set aren't attributed to the manufacturer of the knives but instead are treated exactly as if they happened using ones provided by the business that owns the kitchen.
This means that the only people that we're supposedly catering to here are incompetent IT departments, which doesn't seem worth the hassle for the maintainer or all of the other users.
Or, more likely, this hypothetical IT department that cares enough to block iTerm2 but doesn't care enough to block on the network level is a fiction invented by people who just really hate seeing AI added to everything.
No, they want to be seen taking it seriously, so they say that they take it very seriously. But if you will actually audit their system you will find they do not in reality and it was just a negotiation tactic.
This is a completely ridiculous strawman.
If a corporation needs strict controls then they don't allow for auto-updated software without vetting. They could have asked for a policy to disable the integration but they didn't, instead those people screamed about how they were going to have to completely block iTerm which showed their incompetence. This was in beta for quite a while and none of these "serious IT people" cared so either they are asleep at the wheel (not vetting beta versions) or they allow for auto-updates to software they don't control, either way it screams incompetence to me.
Also we are talking about a terminal here, a tool that can connect wherever the developer tells it to connect to. Are you telling me these companies lock down where a developer can SSH to but are too stupid to block traffic to OpenAI? Or they don't lock down where a developer can SSH and therefore don't talk to me about "strict controls".
Make it make sense. It just doesn't. This argument never held any water for me.
Some described company controls. Some described company policies without controls. Some described their own strong feelings.
Some had auto updated. Some had not. Some did not say.
Some supported their companies' policies. Some stressed the policies were out of their control. Some did not say.
Some asked how to make sure the integration was disabled. Some did ask for a setting an IT department could manage. Some demanded a plugin or separate build. Some said a plugin would work for them.
Many things don't make sense if you assume everyone you disagree with are a collective.
It was opt in, full stop. That should have been the end of this aside from IT managers asking for a group policy or a was to disable the feature (in a nice way).
Everyone complaining could either not update or move to a different tool and ask for a refund... oh wait... that's right, this was open source software. And people wonder why no one wants to maintain open source software. Just add this whole ordeal to the ever-growing pile of reasons why it's almost not worth doing. People are so entitled. My personal favorite were the people that said "If you remove this I'll start support you monetarily", which I assume 99% of those people were lying through their teeth based on the lack of spike in new donations to his patreon [0].
Some were IT managers. Some were users capable to speak for their IT managers. Some did not say. There was no reason comments should have been limited to identified IT managers.
Some asked how to make sure the feature was disabled. Some did ask for a group policy. Some asked for a plugin or separate build because a group policy would not satisfy their company's requirements. The maintainer solicited these requests even though he disagreed with the requirements.
Some blocked the update. Some rolled back. You must know unsupported software has costs.
Do people wonder why more people don't maintain open source software? Most people don't maintain open source software. They have reasons. I think they can imagine other people not maintaining open source software for the same reasons.
I maintained open source software. Attitudes like yours tired me more than the rude minority of users.
Patreon is 1 of 6 donation methods. And I don't think the people who offered to pay $50 meant monthly.
Unless those very strict controls include either blocking at the network level accesses to IP addresses not on a pre-approved list or removing a large number of programs and libraries that are standard on MacOS the person using iTerm will have plenty of readily available ways to use external services with that data if they want to.
Heck, the free version of ChatGPT can tell you how to access ChatGPT with curl if you don't know how [1].
I specifically asked about curl, but it would also work if I asked it to suggest a MacOS command like tool: "On MacOS what command line tools could I use to ask ChatGPT a question? Assume I have a ChatGPT API key". It suggests curl, httpie, and wget and shows how to use all of them. I updated the link below to include that too.
[1] https://chatgpt.com/share/00d9de15-4e43-497f-a116-bfe3972471...
1. Developers are forced to use Windows and given very little CLI access. And they certainly wouldn’t be using iTerm since it’s macOS only.
2. Developers are given a Windows corporate device as well as a MacBook Pro. The MBP doesn’t have access to any corporate systems
3. Developers can access corporate systems on MBP via jamf or InTune. The corporate side of the business accepts the risk that developers can access external (read: non-vetted) services but the business has access to all internet traffic logs from your device (usually pushed into some kind of security package that monitors for suspicious traffic) plus the ability to remote wipe it. So there is a degree of trust given to the developers.
Those that are stuck with option 1 are usually the unhappiest and least productive. So it’s not something most businesses like to entertain unless senior management is very corporate and the business is considered high risk.
If you download this plugin, instead of the feature being securely integrated into the main product binary, there’s a new binary on your system that takes arbitrary JSON and performs network requests. Yes I know curl exists, but thats the point: we don’t need another tool for this that’s way less scrutinized and now opens my system up for data exfiltration in ways that weren’t originally possible. It also suffers from the traditional IPC pitfalls present when not using secure XPC with app groups. It’s objectively worse.
Edit: I’m talking about the separate binary plugin when I call for George to revert. The secure defaults config that can be MDM managed is perfect, simple, and fit for purpose to secure iTerm as a product. Moving the network calls that talk to the configured openai-compatible api server a separate binary is a farce.
You might say that I am not a bright man, and I might agree, but the way the AI integration presented in 3.5.0 was not unequivocal. Literally nothing said “this feature is disabled unless you put an API key in”. It assumed a knowledge and understanding of how this shit works, one that I do t have because I have no interest in slop portals in any of my applications, let alone one in my terminal. Instead of a checkbox for “Enable/Disable”, one I could have left set to disabled and gone about my day, I got an empty text box for an API key. So what, does it attempt to make a network call to Sam Altman’s slop machine every time I hit enter, only to fail without an API key? YeAh bUt Go rEaD tHe sOuRCE, sure, but I’ve been using iTerm since Tiger without a need to go read the source (nor become a terminal application developer in five minutes so I could understand it) and had other shit to do that day.
Mind you, OpenAI.com is NXDOMAINed on my DNS servers at home, so I didnt give a shit either way when I upgraded to 3.5.0.
People’s reactions and comments to the dev were wrong, cruel, and uncalled for, but that doesn’t mean the feature couldn’t have been introduced and presented in a way more sensitive to people’s concerns about AI, right or wrong, real or fake. And sure, the dev has every right to do whatever they want with their open source project. They don’t owe us any emotional intelligence or respect or anything, but they also dont have a right to expect everyone to be like, totally cool and vibin with whatever they do. That doesn’t mean “everyone will put up with whatever” (which is not the same as “everyone is entitled to the project”). If the dev removed all themes except for neon pink on neon green and forced your font to be Comic Sans, would the dev be entitled to do that? Sure! It’s not illegal and they don’t owe anyone anything. Would users be entitled to go “uhh, what the fuck?” Sure! It’s not illegal and they don’t owe anyone anything! It only gets gross when people start flinging insults.