5 ms·

> The key issue here is that people are worried that their private files on Dropbox are being passed to OpenAI to use as training data for their models This is

> The key issue here is that people are worried that their private files on Dropbox are being passed to OpenAI to use as training data for their models This is only part of it. I don’t want my data being sent anywhere unless I authorize it, regardless of what it’s being used for. In this case, we not only have to worry about OpenAI training on our files (I have no reason to doubt that they are truthful when they say they won’t), but we also have to trust that they can securely handle our files.

simonw 3y ago
That's true. It's very reasonable to worry that OpenAI's "we only hold on to your data for 30 days for auditing purposes" policy means there's 30 days in which they might have a breach that leaks your data. Especially since they've had a few documented security problems in the past.
kolinko 3y ago
The same argument could apply to processing data in the cloud, and somehow nobody complains anout the fact that Dropbox stores their data on AWS/Google cloud or wherever
- JohnFen 3y ago
  I complain about my data being stored in the cloud all the time. I won't use services like Dropbox in large part because of the cloud, but I can't do a thing about other entities I do business with storing the data they glean about me in the cloud. It's a real issue.
sneak 3y ago
It’s SaaS vendors all the way down. If you don’t want third (or second) parties reading your data, make sure it is e2e encrypted clientside. This means no Dropbox, but Syncthing instead. That means no Slack or Discord, but Signal.
- the_mitsuhiko 3y ago
  That is not entirely accurate. Thanks to the GDPR subprocessors need to be disclosed and changes to them too. As a result plenty of companies are now much more selective about how many they are willing to entertain.
  - sneak 3y ago
    Courts can only address the issues by applying privacy laws long after your data is leaked and your business or privacy is destroyed. Use clientside encryption. Technical measures, not legal ones.
    - red-iron-pine 3y ago
      to paraphrase a CTO that I used to know: you may win the court case... 3 years from now. your secrets have been on the dark web for that whole time, and have filtered to the regular web by then. even if you know who did it, and can get them extradited they may not have cash to pay for the damages, and seeing them in jail, though nice, won't make your data private again.
notahacker 3y ago
There is also the distinct possibility that the wording is literally true in sense they don't train their model on your data ("train" can be interpreted as having a very specific meaning...), but they nevertheless also undertake some sort of monitoring of the outputs a model produces (which could obviously entail privacy leaks, especially if it's using RAG on your personal files). Seems quite sensible for people not to trust that they fully understand the small print, since (i) they probably don't and (ii) the one thing most AI companies have made clear is that they think they should be able to use whatever material they like however they like, regardless of whether the creator of that material gives them their blessing or not.
- simonw 3y ago
  This is absolutely part of the problem. Even if you have a deep technical understanding of how this stuff works and how these tools are built, you can still have very legitimate questions and doubts about how your data is being used beyond pure model training.

simonw 3y ago

That's true. It's very reasonable to worry that OpenAI's "we only hold on to your data for 30 days for auditing purposes" policy means there's 30 days in which they might have a breach that leaks your data. Especially since they've had a few documented security problems in the past.

kolinko 3y ago

The same argument could apply to processing data in the cloud, and somehow nobody complains anout the fact that Dropbox stores their data on AWS/Google cloud or wherever

JohnFen 3y ago
I complain about my data being stored in the cloud all the time. I won't use services like Dropbox in large part because of the cloud, but I can't do a thing about other entities I do business with storing the data they glean about me in the cloud. It's a real issue.

sneak 3y ago

It’s SaaS vendors all the way down. If you don’t want third (or second) parties reading your data, make sure it is e2e encrypted clientside. This means no Dropbox, but Syncthing instead. That means no Slack or Discord, but Signal.

the_mitsuhiko 3y ago
That is not entirely accurate. Thanks to the GDPR subprocessors need to be disclosed and changes to them too. As a result plenty of companies are now much more selective about how many they are willing to entertain.
- sneak 3y ago
  Courts can only address the issues by applying privacy laws long after your data is leaked and your business or privacy is destroyed. Use clientside encryption. Technical measures, not legal ones.
  - red-iron-pine 3y ago
    to paraphrase a CTO that I used to know: you may win the court case... 3 years from now. your secrets have been on the dark web for that whole time, and have filtered to the regular web by then. even if you know who did it, and can get them extradited they may not have cash to pay for the damages, and seeing them in jail, though nice, won't make your data private again.

notahacker 3y ago

There is also the distinct possibility that the wording is literally true in sense they don't train their model on your data ("train" can be interpreted as having a very specific meaning...), but they nevertheless also undertake some sort of monitoring of the outputs a model produces (which could obviously entail privacy leaks, especially if it's using RAG on your personal files). Seems quite sensible for people not to trust that they fully understand the small print, since (i) they probably don't and (ii) the one thing most AI companies have made clear is that they think they should be able to use whatever material they like however they like, regardless of whether the creator of that material gives them their blessing or not.

simonw 3y ago
This is absolutely part of the problem. Even if you have a deep technical understanding of how this stuff works and how these tools are built, you can still have very legitimate questions and doubts about how your data is being used beyond pure model training.