On: iTerm2 v3.5.1 moves AI features into external plugin

[dsr_]

"Security theatre" means doing complicated things which are claimed to increase security but don't do that.

The classic example is making everyone at US airports take off their shoes, have their shoes x-rayed, and then putting them back on -- for decades after the single incident in which a man failed to blow up a plane with explosives in his shoes. https://en.wikipedia.org/wiki/Richard_Reid

Moving code out into an optional plugin -- so that it can be verified not to be in use or even removed -- is not theatre.

[rapatel0 → dsr_]

ITerm2 is open source. You can already verify that the plugin is not being used.

Also, how exactly is the functionality going to run without manually adding the API key?

Its code to invoke a request to an API. where exactly is the attack surface? It’s not running an endpoint.

Finally, it’s a terminal app. It has access to way more powerful and sensitive tools with higher security risk

To be more accurate I guess i could have said privacy theatre but i think the point stands.