Hacker News Reader

Comment by iknowSFR | Hacker News Reader

Every AI tool being released by 3rd parties is being blacklisted by my company. The primary reasoning is around sharing data with tool itself. On the other hand, if my clients allow them, there’s a long review and approval process followed by continuous audits.

Is anyone else running into this at their companies? I look at these tools and get excited but I’m continuously being blocked from using for work.

View on HN

My very large corporation is 100% all in on Figma, but has recently blocked several tools and have signaled (through meetings and memo's) that their AI tools will also be blocked.

As an aside, I work in accessibility and our team started using some AI and automated tools to do some A11Y testing and much of the functionality has been blocked. We were really interested in the companies mobile testing tool but now we won't be able to use that because of the network restrictions.

I've also heard complaints from Devs who said GitHub Copilot has also been blocked and they've been in discussions with the security team to try and get approved, but no luck thus far, they're not budging on allowing it yet.

So you're right, its not just one app or tool, companies are staring to block this stuff wholesale across their orgs.

> I've also heard complaints from Devs who said GitHub Copilot has also been blocked

I am soooo glad that I do not work for a very large corporation anymore. Man, the hurdles they create are a massive pain in the rear.

I work for a small 10-person company. I get to make the rules. And we are never hard ass about the rules. I don't think I have been this productive at any job in the past.

I understand that a 100,000 person company has different set of concerns. But I do think that an average developer at smaller company is more productive because they have to deal with a lot less BS.

I don't get this. Obviously Figma already stored all your designs in their cloud. What's the additional problem with also getting AI suggestions back from Figma?

The problem is when other people are getting 'AI suggestions' based on your work. What if you don't own the copyright for the work you're producing (it's for a client)? What if you don't what AI being trained on your data?

By default, Figma will not using organizations' data to train.

But only for organisation and enterprise plans!

> Starting today, admins can set that content data training preference directly in settings, across all plans.

> -Starter and Professional plans are opted in by default, but can opt out.

> - Organization and Enterprise plans are opted out by default.

Figma is explicit about this:

> Two important highlights: First, all admins have control of whether their team’s content data is used for training. Second, participation in AI content training is not required to use Figma or Figma’s AI features. Learn more about our approach to training.

Blanket bans on third party AI tools don't make any sense to me. As the parent commenter said, they already have all your data, so you already have to trust them with that. Why would you trust them in those other areas but not trust their explicit statements that say that you can disable training on your data?

If Figma takes a little inspiration from Adobe (they were almost acquired at one point after all) they'll realize they can change their TOS at any time for any reason with impunity. Such statements are at best dubious and at worst complete unprovable bullshit.

The only way to be sure your data stays yours is local models running on your machines.

This applies to all non self hosted software and even much self hosted software that radios out invasive telemetry. The difference between offering an AI feature or not offering it is time, but collecting your data as training for that eventually inevitable AI feature is happening now, everywhere, all the time. The only defense is retreat into a SKIF or depend on ToS, and as you point out ToS is a very weak defense. Things are moving considerably faster than law, regulation, judicial review, and establishment of a compliance framework can possibly accommodate.

Welcome to the future you were promised! It’s already too late.

> Blanket bans on third party AI tools don't make any sense to me

It's an easy, safe and secure default.

I agree with this, I think I was just interpreting "ban" differently. I.e. if the default is you can't use it, but then there is a specific request/review/audit process to allow it (as original GP's comment said), that makes sense. I just don't think it makes sense to ban without an exception process.

I think the “easy” bit is increasingly not true, given that blanket AI feature bans mean you’ve banned both Mac OS and Windows.

Is that control opt-out by default?

Another commenter mentioned that the default is no training for Enterprise and Organization accounts, but for Starter and Professional accounts the default allows training and you need to explicitly opt out.

Once again saying that these dark patterns should be illegal.

The language in the announcement looks tricky (albeit I didn't get into the legal document). It says NEW content won't be used for training. Also, it's going to be on for a moment. You have to go out of your way to turn it off. They could claim they copied your info in the hour or so before you got around to it.

My organization is kind of just not talking about AI tools and the obvious risks. We've gotten neither a ban nor an all-clear, leaving us to use it according to our own judgment and not talk about it very much. I think more companies are in this boat, and while I understand your frustration, your company is making the wiser move (although it may bite them; some of the more reckless companies will die for their carelessness but others will survive and pull ahead faster).

What you have to do, to get around this is to negotiate a contract with the company providing the AI tools, which explicitly forbids them from doing that.

This is how corporations solve these kinds of issues. As soon as you as a company are a customer instead of some random person using their AI tools, you start to actually have influence over the other company.

As mentioned elsewhere, you don't need some special contract. Figma allows anyone to opt out of training (though I think it's a fair point that only Enterprise and Organization plans are opted out by default, while Starter and Professional plans you have to explicitly select opt out).

Nearly every SaaS tool I've seen that has AI features lets you opt out of training, as these SaaS companies know that this is a deal breaker for many of their clients.

Which I think is also unsurprising, it takes the insanity of Adobe to want to claim your customers work for you.

But this is exactly the type of situation why you have a contract. Even if it is standard, this is the means by which you can enforce the AI company to not use your data.

Yep lots of companies are (rightfully) being careful about 3rd party AI tools. You're sending valuable company assets or in some cases even PII (though probably not for Figma) to another party and you're basically hoping they aren't being careless.

Total security (and possibly legal) nightmare.

If Figma is using OpenAI API on the back-end for this, does the data they relay to OpenAI get protected? (Not sure if they do, but curious if their solution is on-prem or being handled by a 3rd party)

I saw this in a few of my friends' companies. I have asked to everyone how is storing data in Azure is better than using Azure ChatGPT API, and till now I haven't been able to get a good answer.

This. If you don't trust your provider when it says it won't use data you embed in your LLM API Calls, why do you trust them when you use any of their other services?

Because those other services are built with clear expectations of tenant isolation, and cross-tenant data leakage would be a near-fatal event.

But the models behind these AI tools have a single-tenant core, with tenant isolation added on as a heroic effort to fake what the technology does not support by default.

That's like asking why is it ok the use AWS to host my containers but it's not ok to leave company files in some other guy's S3 bucket.

No it isn't, the Azure ChatGPT API is operated by Azure, not OpenAI.

Still, it makes sense, as if your company is serious about data protection in the first place, it isn't just "using Azure", but has a contract with guarantees. Guarantees that don't carry over to randos using Azure just because it's Azure.

The answer is likely in the contract your company has with Microsoft.

It's a pretty standard terms for all the companies unless you are huge.

Reply on news.ycombinator.com