4 ms·

> If there's no safe alternative available in the space Otter is in (and if you need a transcription tool now to be competitive as a journalist, perhaps) it mea

> If there's no safe alternative available in the space Otter is in (and if you need a transcription tool now to be competitive as a journalist, perhaps) it means there's a market for building one. Right, but in the meantime, if a government is hunting me and a journalist asks me to interview them, I want to know I'm secure. I don't want that to be reliant on whether or not a market I know nothing about exists. Definitely, it looks like there's a need for a safe transcription app for journalists. But that's not a license for them to be dangerous while they're waiting for that product to exist. Journalists have a moral responsibility to keep their sources safe in the world that exists today. Otherwise, the takeaway seems to be that nobody with really sensitive information or in a vulnerable position should talk to journalists until after the tech industry builds an entirely new product, which probably isn't the outcome that anybody wants. We need to hammer out some degree of data security best practices that journalists won't break even in the instances where it makes their lives more inconvenient. Ideally, we should try to hammer out best practices that make it possible for a journalist to evaluate whether or not a service is appropriate to use. Otherwise we'll just play this endless game of cat and mouse where someone builds a transcription service that's private, and then another company builds this data-leaking collaboration or markup platform and that hole gets opened... at some point we have to teach journalists that there are certain types of services that they should stay away from unless they meet certain criteria, and it sounds like a lot of journalists don't have a good grasp on how to do that kind of security evaluation. Certainly, there's at least lack of education here about why we're using E2EE and what specific attacks it guards against if it's not ringing alarm bells with journalists when a service asks them to upload the raw interview to a remote server.

Spooky23 5y ago
E2EE is irrelevant imo as it solves one specific problem, and many people have a tunnel vision beyond it. Everyone has a smartphone. I can guarantee that at any scale, there is some nut recording their entire day. I’ve worked at places where that’s a real threat that is difficult to manage.
- danShumway 5y ago
  It's one specific problem with a solution that is invalidated by uploading the recording to a 3rd-party service. E2EE is not the only security measure a journalist should be taking, but it is one, and it is a fairly basic measure that isn't too tough for someone in the field to explain. The reason why we advise E2EE is to make sure that the recording is only unencrypted and listenable on devices you control, it's not just because we like Signal. Transferring it raw to another service invalidates the point of doing your call over something like Signal in the first place, because the purpose was to not have the recording sitting unencrypted on someone else's servers that you don't own or manage. My impression is that if a journalist is doing E2EE and then sending the recording off afterwards, they probably don't understand why that advice was given and they probably don't have an understanding of what the risks are we're trying to protect against when we tell them to do remote interviews over an E2EE service. We want journalists to be thinking about their source's privacy on a level beyond "I use Signal because I was told to." I get what you're saying -- E2EE is not a solution to every problem, and you're right about that, there are other security risks that are in separate categories. But what I'm getting at is not to say that it does solve every problem; just that if a journalist doesn't understand not to send recordings off someplace, to me that indicates a lack of knowledge about other security concepts.
pabs3 5y ago
The Mozilla DeepSpeech spin-off Coqui has an STT that is locally installable: https://coqui.ai/ https://coqui.ai/

Spooky23 5y ago

E2EE is irrelevant imo as it solves one specific problem, and many people have a tunnel vision beyond it. Everyone has a smartphone. I can guarantee that at any scale, there is some nut recording their entire day. I’ve worked at places where that’s a real threat that is difficult to manage.

danShumway 5y ago
It's one specific problem with a solution that is invalidated by uploading the recording to a 3rd-party service. E2EE is not the only security measure a journalist should be taking, but it is one, and it is a fairly basic measure that isn't too tough for someone in the field to explain. The reason why we advise E2EE is to make sure that the recording is only unencrypted and listenable on devices you control, it's not just because we like Signal. Transferring it raw to another service invalidates the point of doing your call over something like Signal in the first place, because the purpose was to not have the recording sitting unencrypted on someone else's servers that you don't own or manage. My impression is that if a journalist is doing E2EE and then sending the recording off afterwards, they probably don't understand why that advice was given and they probably don't have an understanding of what the risks are we're trying to protect against when we tell them to do remote interviews over an E2EE service. We want journalists to be thinking about their source's privacy on a level beyond "I use Signal because I was told to." I get what you're saying -- E2EE is not a solution to every problem, and you're right about that, there are other security risks that are in separate categories. But what I'm getting at is not to say that it does solve every problem; just that if a journalist doesn't understand not to send recordings off someplace, to me that indicates a lack of knowledge about other security concepts.

pabs3 5y ago

The Mozilla DeepSpeech spin-off Coqui has an STT that is locally installable: https://coqui.ai/ https://coqui.ai/