Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

171–180 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#171

Earlier quoted context omitted.

If you're using Github already then Copilot isn't seeing anything new.

Correct, but that level of security is expected from GitHub proper, they have all sorts of independent security reviews for their partners. Does all of that exist for Copilot?

Yes

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#172
I believe there were FUD pieces like this when internet search engines were rolled out, and again when social media became popular. I suppose its universal for new technologies.

I had an interview awhile ago at a place where during the phone screen "they can't talk about their tech stack in detail" so I looked on linkedin and figured out their entire tech stack before on the onsite interview. Come on guys, according to linkedin, you have an entire department of people doing AWS with Terraform and Ansible, you don't have to pretend you can't say it in public.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#173
post #45

Earlier quoted context omitted.

Why isn't it read-only by default? it's not even connected to the internet

ChatGPT, and I think all the GPT LLMs, is only accessible over the internet as far as I can tell. And the thumbs up/down are there on the chat interface because it's partly trained by reinforcement from human feedback.

Nope. LLMs don't use the internet for inference at all unless you give it access to a web search api or something like that. chtGPT is just too massive to run on any local machine. But make no mistake, it does not require the internet.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#174
post #153

Earlier quoted context omitted.

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

Do you really think the people asking ChatGPT to write their code can make that abstraction? The fact that the can't do this is the whole reason they have to use ChatGPT.

I use it because it's 10-100x more interesting, fun, and fast as a way to program, instead of me having to personally hand-craft hundreds of lines of boilerplate API interaction code every time I want to get something done.

Besides, it's not like it puts out great code (or even always working code), so I still have to read everything and debug it. And sometimes it writes code that is just fine and fit for purpose and horrendously ugly, so I still have to scrap everything and do it myself.

(And then sometimes I spend 10x as long doing that, because it turns out it's also just plain good fun to grow an aesthetic corner of the code just for the hell of it, too — as long as I don't have to.)

And even after all that extra time is factored back in: it's still way faster and more fun than the before-times. I'm actually enjoying building things again.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#175
post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

This really depends on the cost/benefit tradeoff for the entity in question. If using ChatGPT makes you X% more productive (shipping faster / lowers labor costs / etc), but comes with Y% risk of data leakage, is that worth it in expectation or not? I would argue that there definitely exist companies for which it's worth the tradeoff. By the way, OpenAI says they wont use data submitted through its API for model train…

Risk of leakage? It is not a risk, it is a matter of time.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#176

Earlier quoted context omitted.

But it really seems like a cat and mouse game. For example, a very determined bad actor could infiltrate some lesser approved government contractor and provide an additional interface/API which would invite such information leaking, and possibly nobody would notice for a long time.

And then they could face death penalty for espionage if they leaked sensitive enough data. You would have to be really stupid to build such a service for government contractors unless you actually are a foreign spy.

At least then we would finally find out if it is constituional to execute someone for espionage.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#177
post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

So you block internet access for all employees? Cos anything you think is being pasted into ChatGPT is being pasted everywhere, whether its Google, Slack, Chrome Plugins, public Wifi.

Or all the ChatGPT clones that have sprung up and will continue to spring up every other day.

It's a stupid and patronizing position, but corporate IT are sadly incentivised to be stupid and patronizing.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#178
post #115
post #109

Earlier quoted context omitted.

> some other AI sitting on your own secured hardware, maybe even a branch of ChatGPT. Where can I, a random employee, get that? I know how to get ChatGPT.

You can't. So maybe you as a random employee should just do without whatever IT hasn't approved whether you agree or not.

Right, thus meaning your employer gets outcompeted by a company willing to take the risk of handing their data to OpenAI.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#179
post #96

Earlier quoted context omitted.

If they're more productive by doing it, I think it's an equal chance said dev gets promoted.

Why? Uploading code to ChatGPT can be done by trainees.

Yeah, but the code coming out of ChatGPT is generally not in a state that you want to commit straight into you repo. Making adjustments (and writing the original prompt) is where your expertise comes in.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#180
post #83

Earlier quoted context omitted.

> Think about how long it's taken tools like pandas to reach the point that it is now. That entire package can be built to the level it is now in a couple of days. I don't think that is true at all. Do you have an example of a significant project being duplicated in days, or even months, with ANY of these tools? By significant, I mean something on the order of pandas which you claimed.

And this is completely ignoring the fact, that the real hard problem is the design. Spitting boilerplate code is not. How pandas could be designed perfectly in one afternoon (and generated with GPT) is beyond my comprehension.

I guess they are thinking that ChatGPT would also handle that part ...

Prompt 1: What would be an amazing tech project that would make me rich?

P2: Produce an excellent design for that project. Should be elegant and use microservices and scale to billions of users.

P3: Write all the code for this design.

P4: Tell me how to test and deploy all that code.

P5: How to sell all this for billions?

Post reply on HN