4 ms·

We are open-sourcing the code, and people can have their own network monitoring to see that there is no data leaking

by oulipo 9y ago

jacquesm 9y ago
Please check into 'reproducible builds' and ways to ensure the software is not modified between the point where you build it and the point where it gets deployed. There will most likely at some point be an attempt to use your reputation to achieve the exact opposite of your stated goals so beware of that.
- oulipo 9y ago
  We'd love to hear more about what you think of this, perhaps you can contact me mael.primet@snips.ai and I would love to do a Skype with you, if only because I read quite a few of your posts over the year and am curious to know you. We are providing the source, and people can rebuild it from scratch and ensure that their device is running the open-source code. In theory, it is each user who should deploy his device. If an industrial partners want to ship our software to many devices, indeed it will be needed for them to prove he hasn't modified the software and we are happy to learn about best practices to help them do so, so we will look at this
  - jacquesm 9y ago
    I'm sorry, I don't do skype or hangouts but I'll be happy to email with you. However, it is probably better if you find someone who is really an expert in the field. But I can definitely see that there is a potential problem here if you are open sourcing your code and industrial partners ship your software without some kind of clear way in which you can ascertain that what got shipped is what you intended and not some kind of perverted variation. This might be a good starting point: https://reproducible-builds.org/ https://reproducible-builds.org/
  - ryandrake 9y ago
    > If an industrial partners want to ship our software to many devices, indeed it will be needed for them to prove he hasn't modified the software and we are happy to learn about best practices to help them do so, so we will look at this Yea, as a privacy conscious user this would be the attack vector that I’d be most nervous about. “Partners” taking the open source engine and loading it up with surveillance. Being able to re-compile and deploy a vanilla version from source is critical. There are a lot of “smart” devices out there that I would buy if only I had root and/or could decide what software ran on it.
  - craftyguy 9y ago
    Will the device have any components in it which require proprietary firmware? Think long and hard about that before answering. edit: I thought you were also doing something similar to Mycroft and their 'mark 1' thing. I was wrong.
    - oulipo 9y ago
      Our platform doesn't require any specific component. It will be open-source and free for all users to use and create assistants. If an industrial device maker wants to use the open-source version and add to it proprietary components, it will be his decision and he should inform his customers. The best we can do when building and open-sourcing our assistant platform is to make it possible for commercial vendors to create state-of-the-art private-by-design voice assistants if they want
      - craftyguy 9y ago
        So no components in your device (e.g. for wifi) require proprietary firmware to function? Are you sure about that?
        jacquesm 9y ago
        They make software, not hardware, they could not make such a guarantee.
        craftyguy 9y ago
        Ah, I didn't realize that. I thought they were trying to do something like Mycroft with the Mark 1. Mycroft releases their platform to be installed on other devices, but they also make their own (Mark 1).
      - entropie 9y ago
        I spent like 60 seconds on your page trying to figure out what exactly you do and failed. Just saying. Put some of the information of your posts here on your page and things would be much clearer.
josefresco 9y ago
"and people can have their own network monitoring" Is this monitoring built into your product? If not, wouldn't a user of any AI assistant have this same ability?
- dwighttk 9y ago
  The monitoring is to see if the product is making network connections, you can do that with any AI assistant, yes, but the Google and Amazon products are going to require you to allow them to make those connections. This claim is that you can see that this product isn't making connections. (I think)
- oulipo 9y ago
  You can use a tool like `mitmproxy` to monitor the network requests

We are open-sourcing the code, and people can have their own network monitoring to see that there is no data leaking

by oulipo 9y ago

We are open-sourcing the code, and people can have their own network monitoring to see that there is no data leaking

Please check into 'reproducible builds' and ways to ensure the software is not modified between the point where you build it and the point where it gets deployed. There will most likely at some point be an attempt to use your reputation to achieve the exact opposite of your stated goals so beware of that.

oulipo 9y ago
We'd love to hear more about what you think of this, perhaps you can contact me mael.primet@snips.ai and I would love to do a Skype with you, if only because I read quite a few of your posts over the year and am curious to know you. We are providing the source, and people can rebuild it from scratch and ensure that their device is running the open-source code. In theory, it is each user who should deploy his device. If an industrial partners want to ship our software to many devices, indeed it will be needed for them to prove he hasn't modified the software and we are happy to learn about best practices to help them do so, so we will look at this
- jacquesm 9y ago
  I'm sorry, I don't do skype or hangouts but I'll be happy to email with you. However, it is probably better if you find someone who is really an expert in the field. But I can definitely see that there is a potential problem here if you are open sourcing your code and industrial partners ship your software without some kind of clear way in which you can ascertain that what got shipped is what you intended and not some kind of perverted variation. This might be a good starting point: https://reproducible-builds.org/ https://reproducible-builds.org/
- ryandrake 9y ago
  > If an industrial partners want to ship our software to many devices, indeed it will be needed for them to prove he hasn't modified the software and we are happy to learn about best practices to help them do so, so we will look at this Yea, as a privacy conscious user this would be the attack vector that I’d be most nervous about. “Partners” taking the open source engine and loading it up with surveillance. Being able to re-compile and deploy a vanilla version from source is critical. There are a lot of “smart” devices out there that I would buy if only I had root and/or could decide what software ran on it.
- craftyguy 9y ago
  Will the device have any components in it which require proprietary firmware? Think long and hard about that before answering. edit: I thought you were also doing something similar to Mycroft and their 'mark 1' thing. I was wrong.
  - oulipo 9y ago
    Our platform doesn't require any specific component. It will be open-source and free for all users to use and create assistants. If an industrial device maker wants to use the open-source version and add to it proprietary components, it will be his decision and he should inform his customers. The best we can do when building and open-sourcing our assistant platform is to make it possible for commercial vendors to create state-of-the-art private-by-design voice assistants if they want
    - craftyguy 9y ago
      So no components in your device (e.g. for wifi) require proprietary firmware to function? Are you sure about that?
      - jacquesm 9y ago
        They make software, not hardware, they could not make such a guarantee.
        craftyguy 9y ago
        Ah, I didn't realize that. I thought they were trying to do something like Mycroft with the Mark 1. Mycroft releases their platform to be installed on other devices, but they also make their own (Mark 1).
    - entropie 9y ago
      I spent like 60 seconds on your page trying to figure out what exactly you do and failed. Just saying. Put some of the information of your posts here on your page and things would be much clearer.

josefresco 9y ago

"and people can have their own network monitoring" Is this monitoring built into your product? If not, wouldn't a user of any AI assistant have this same ability?

dwighttk 9y ago
The monitoring is to see if the product is making network connections, you can do that with any AI assistant, yes, but the Google and Amazon products are going to require you to allow them to make those connections. This claim is that you can see that this product isn't making connections. (I think)
oulipo 9y ago
You can use a tool like `mitmproxy` to monitor the network requests