5 ms·

That's a lot of trust in a black box coded by humans. What's going on under the hood with their Smart Compose? Smart Reply? Smart Labels? It all requires proces

That's a lot of trust in a black box coded by humans. What's going on under the hood with their Smart Compose? Smart Reply? Smart Labels? It all requires processing very very personal information, and you simply can't vet whether it's all handled securely.

mehrdadn 8y ago
Sure, you're trusting their code is bug free. That's just (lack of) faith on your end. The fact that you decide not to trust their competence certainly does not logically imply that they are invading your privacy. It just means you need to trust their competence or take your business to some company you deem more competent. (Though exactly which company would be more competent in infosec is quite the question, but I digress.)
- prophesi 8y ago
  No, it's a lot more than just trusting that their code is bug-free. It's trusting that they're actually only doing what they claim to be doing with your data. The only solution is to have the code open sourced with reproducible builds and a checksum to verify it against. Pretty much every GApp has a free, libre, open-source alternative that respects your privacy in this way.
  - mehrdadn 8y ago
    Even that: if you lack trust on your part, that does not imply what someone else is doing is an invasion of your privacy. If you claim someone is invading your privacy, that is an accusation... a serious one at that. To support it you need to actually describe how that is happening, not merely how you have problems trusting people who deal with your information. I don't see how this is not obvious.
    - prophesi 8y ago
      It's why GDPR came into being, and California's recent data privacy law. We have no reason to have faith in these companies to keep our data safe, or to use it properly. After 10+ years of having our credit card numbers, social security numbers, emails, passwords, and so on leaked again and again, I fail to see how one wouldn't have trust issues at this point.
      - mehrdadn 8y ago
        I never said you can't have trust issues or that GDPR isn't necessary, I'm saying neither of those implies they are invading your privacy when they show you ads based on your emails. This should be pretty clear?
        prophesi 8y ago
        The root of the issue is that if they _are_ invading your privacy, you wouldn't be able to tell. https://en.wikipedia.org/wiki/Black_box https://en.wikipedia.org/wiki/Black_box
        mehrdadn 8y ago
        Yes, and if they aren't, you wouldn't be able to tell either, so all that means is you're willing to recklessly make unjustified accusations to defame a company without actual evidence.
        prophesi 8y ago
        Well, we already know they require reading your emails to power their Smart features. That's enough of an invasion of my privacy to use a FOSS alternative, and I'll always be an advocate for this.
        pas 8y ago
        Which makes sense, but reading emails to provide smart features is not an automatic loss of privacy. Google runs the SmartBot2000 software for you. If you use FOSS but run it on AWS EC2, you still need to trust the software, manage the upgrades (or trust the auto upgrade feature, trust the maintainers), and trust AWS for not fucking with your VM. We have a few physical servers. And probably always will. We run our own email, but also use gmail too. Because sometimes our email breaks, sometimes [understandably fewer times] gmail breaks (or is not available, such as in China). And we will probably always run our email, but it's a lot of work, and it's not for everybody. And even though postfix, dovecot and K9/thunderbird/roundcube are all fine, they are not as smart as gmail. (but usually snappier) You need decades of experience to set up a secure email host. GMail does it for people in exchange for showing them ads. (uBlock FTW, BTW) NSA/Prism is a valid reason to use your own mailserver, but then again, keeping up with TLS/OpenSSL issues is a valid reason to use a non-self-hosted solution (as they do it for you, though gmail accepts unencrypted SMTP :/). And of course, at the end of the day, there's ProtonMail!

mehrdadn 8y ago

Sure, you're trusting their code is bug free. That's just (lack of) faith on your end. The fact that you decide not to trust their competence certainly does not logically imply that they are invading your privacy. It just means you need to trust their competence or take your business to some company you deem more competent. (Though exactly which company would be more competent in infosec is quite the question, but I digress.)

prophesi 8y ago
No, it's a lot more than just trusting that their code is bug-free. It's trusting that they're actually only doing what they claim to be doing with your data. The only solution is to have the code open sourced with reproducible builds and a checksum to verify it against. Pretty much every GApp has a free, libre, open-source alternative that respects your privacy in this way.
- mehrdadn 8y ago
  Even that: if you lack trust on your part, that does not imply what someone else is doing is an invasion of your privacy. If you claim someone is invading your privacy, that is an accusation... a serious one at that. To support it you need to actually describe how that is happening, not merely how you have problems trusting people who deal with your information. I don't see how this is not obvious.
  - prophesi 8y ago
    It's why GDPR came into being, and California's recent data privacy law. We have no reason to have faith in these companies to keep our data safe, or to use it properly. After 10+ years of having our credit card numbers, social security numbers, emails, passwords, and so on leaked again and again, I fail to see how one wouldn't have trust issues at this point.
    - mehrdadn 8y ago
      I never said you can't have trust issues or that GDPR isn't necessary, I'm saying neither of those implies they are invading your privacy when they show you ads based on your emails. This should be pretty clear?
      - prophesi 8y ago
        The root of the issue is that if they _are_ invading your privacy, you wouldn't be able to tell. https://en.wikipedia.org/wiki/Black_box https://en.wikipedia.org/wiki/Black_box
        mehrdadn 8y ago
        Yes, and if they aren't, you wouldn't be able to tell either, so all that means is you're willing to recklessly make unjustified accusations to defame a company without actual evidence.
        prophesi 8y ago
        Well, we already know they require reading your emails to power their Smart features. That's enough of an invasion of my privacy to use a FOSS alternative, and I'll always be an advocate for this.
        pas 8y ago
        Which makes sense, but reading emails to provide smart features is not an automatic loss of privacy. Google runs the SmartBot2000 software for you. If you use FOSS but run it on AWS EC2, you still need to trust the software, manage the upgrades (or trust the auto upgrade feature, trust the maintainers), and trust AWS for not fucking with your VM. We have a few physical servers. And probably always will. We run our own email, but also use gmail too. Because sometimes our email breaks, sometimes [understandably fewer times] gmail breaks (or is not available, such as in China). And we will probably always run our email, but it's a lot of work, and it's not for everybody. And even though postfix, dovecot and K9/thunderbird/roundcube are all fine, they are not as smart as gmail. (but usually snappier) You need decades of experience to set up a secure email host. GMail does it for people in exchange for showing them ads. (uBlock FTW, BTW) NSA/Prism is a valid reason to use your own mailserver, but then again, keeping up with TLS/OpenSSL issues is a valid reason to use a non-self-hosted solution (as they do it for you, though gmail accepts unencrypted SMTP :/). And of course, at the end of the day, there's ProtonMail!