Hacker News Reader

Comment by breadwinner | Hacker News Reader

It seems every IDE now has AI built-in. That's a problem if you're working on highly confidential code. You never know when the AI is going to upload code snippets to the server for analysis.

View on HN

Not trying to be mean but I would expect comments on HN on these kind of stories to be from people who have used AI in IDEs at this point. There is no AI integration that runs automatically on a codebase.

There is automatic code indexing from Cursor.

Autocomple is also automatically triggered when you place your cursor inside the code.

Yes, Cursor, “The AI Code Editor.”

Cursor is an AI IDE and not what they are describing.

This could change on a daily basis, and it's a valid concern anyway.

Gitkraken does

> There is no AI integration that runs automatically on a codebase.

Don't be naive.

This is HN. 10 years ago that would be true, but now I expect 99% of commenters to have newer used the thing they are talking about or used it once 20 years ago for 10 minutes, or even nkt read the article.

> "add their existing paid Claude account to Xcode and start using Claude Sonnet 4"

Wont work by default if I'm reading this correctly

Neovim and Emacs don’t have it built in. Use open source tools.

They both support it via plugins. Xcode doesn’t enable it by default, you need to enable it and sign into an account. It’s not really all that different.

That seems perfectly fine and noncontroversial then. Good on Apple for doing it that way.

This is not a realistic concern. If you're working on highly confidential code (in a serious meaning of that phrase), your while environment is already either offline or connecting only through a tightly controlled corporate proxy. There's no accidental leaks to AI from those environments.

thanks for giving the security department more reasons to think that way.

I spent the last 6 months trying to convince them not to block all outbound traffic by default.

The right middle ground is running Little Snitch in alert mode. The initial phase of training the filters and manually approving requests is painful, but it's a lot better than an air gap.

that’s what I do, but since it’s in my control the security teams don’t like it. ;)

There are ranges of security concerns and high confidentiality.

For most corporate code (that is highly confidential) you still have proper internet access, but you sure as hell can't just send your code to all AI providers just because you want to, just because it's built into your IDE.

Well that depends on whether you give it access or not, apple’s track record with privacy gives me some hope

No. It’s always something you have to turn on or log into.

Also, there are plenty of editors and IDEs that don’t.

Let’s stop pretending like you’re being forced into this. You aren’t.

On IDEA the organisation who controls the license can disable the build in (remote) AI. (Not the local auto complete one)

But I guess the user could still get a 3rd party plugin.

Most of the big corporations will have a special contract with the AI labs with 0 retention policies.

I do not think this will be an issue for big companies.

Sublime Text doesn't by default.

If it's that confidential you should be on an airgapped network.

There's simply no way to properly secure network connected developer systems.

People working on highly confidential code will NOT have access to the public internet.

There is a gulf and many shades between "this code should never be on an internet-connected device" and "it doesn't matter if this code is copied everywhere by absolutely anyone".

To me "highly confidential" would mean "isolated from the internet" or else it isn't going to be "highly confidential" for very long.

Have you seen a lot of code from Klarna, Storytel, Spotify (companies I've worked at)?

None of these companies are isolated from the internet.

I bet their devs are.

You do know: when it's enabled.

many enterprises store their code on GitHub, owned by Microsoft, operator of Copilot

you can use Claude via bedrock and benefit from AWS trust

Gemini? Google owns your e-mail. Maybe you're even one of those weirdos who doesn't use Google for e-mail - I bet your recipient does.

so... they have your code, your secrets, etc.

Reply on news.ycombinator.com