It was never opt-in in the previous build. You had to explicitly enable and add ...

dsr_ · 2024-06-12T14:24:31 1718202271

"Security theatre" means doing complicated things which are claimed to increase security but don't do that.

The classic example is making everyone at US airports take off their shoes, have their shoes x-rayed, and then putting them back on -- for decades after the single incident in which a man failed to blow up a plane with explosives in his shoes. https://en.wikipedia.org/wiki/Richard_Reid

Moving code out into an optional plugin -- so that it can be verified not to be in use or even removed -- is not theatre.

rapatel0 · 2024-06-14T11:31:08 1718364668

ITerm2 is open source. You can already verify that the plugin is not being used.

Also, how exactly is the functionality going to run without manually adding the API key?

Its code to invoke a request to an API. where exactly is the attack surface? It’s not running an endpoint.

Finally, it’s a terminal app. It has access to way more powerful and sensitive tools with higher security risk

To be more accurate I guess i could have said privacy theatre but i think the point stands.

prymitive · 2024-06-12T14:12:08 1718201528

It might be one of the first examples of a piece of code getting “cancelled”.

rasengan · 2024-06-12T14:12:42 1718201562

I stand corrected. Thank you.

AI doesn't need to be anywhere near the Terminal without explicit intervention from the user, and I'm glad it's now in an external plugin.