4 ms·

I certainly don't "trust" OpenAI or any other big company about what they say they did, or will do, or are doing. Yet I believe OpenAI isn't using data from Dr

by bambax 3y ago

I certainly don't "trust" OpenAI or any other big company about what they say they did, or will do, or are doing. Yet I believe OpenAI isn't using data from Dropbox to train their models without users' consent. BUT I don't think that's the problem here. The problem is data in transit; data sent to third parties who can actually read it, and who may have rogue employees that Dropbox has no control over; data that can appear in logs or subject to different policies, etc. If I send private data to Dropbox they can't send it to anyone for any reason, including "improving" their product, without my explicit and informed consent. I'm not sure how this is even debatable. If Dropbox wants to house models and offer RAG search themselves, to consenting users, that's one thing. If Dropbox sends all data of all users to third parties without telling anyone before the fact, that's another thing. A terrible thing.

schnable 3y ago
Exactly. It's all about who can see my sensitive data, period.
lukeschlather 3y ago
> If Dropbox wants to house models and offer RAG search themselves, to consenting users, that's one thing. Well, I'm a paying Dropbox customer, and I would not pay for this feature. I would like it if they encrypted my data in a way that made offering this sort of feature impossible. I do want my data recoverable, but the fact that they can offer this AI "feature" at all, it seems like they've made zero effort to prevent malicious internal employees or third parties from accessing my data.
- hinkley 3y ago
  It’s like when forgot my password features send you back your current password instead of a new temporary one. Great, I’m back in my account, but now I dread even being here. What other stupid shit are you doing?
Swizec 3y ago
> If Dropbox sends all data of all users to third parties without telling anyone before the fact, that's another thing If they've ever signed a BAA (business associate agreement) with any enterprise customers using Dropbox for documents bound by HIPAA, this would get them into a lot of trouble very quickly. The financial penalties are _high and per exposure per employee involved_. They also hit employees doing directly (if you disclose/share HIPAA info then you personally are liable). So I'm certain that even if they did share documents with undisclosed 3rd parties without notice, it wouldn't be "all". Enterprise data is likely safe. Those contracts get heavy scrutiny before signing.
blibble 3y ago
> Yet I believe OpenAI isn't using data from Dropbox to train their models without users' consent. why? they trained on my code without my consent, why is user data any different? training is either fair use or it isn't and high growth Silicon Valley companies aren't known for the adherence to the spirit of the law
- vorticalbox 3y ago
  Just out of interest I have a few questions. 1. How do you know for sure it was trained on your code? 1.1 if you saw it reproduce you code verbatim how do you know it didn't just hallucinate it ? 2. Was you code publicly available? 3. What licence was it under?
  - spatley 3y ago
    Well Github says it out loud: “ GitHub Copilot is trained on all languages that appear in public repositories.” Note it says “public” and not “open source” https://docs.github.com/en/copilot/overview-of-github-copilot/about-github-copilot-individual# https://docs.github.com/en/copilot/overview-of-github-copilo...
- d4mi3n 3y ago
  Training against your code shouldn't be kosher if your code isn't open, you retain a copyright, and you didn't consent. Even if training on copyrighted, private code _was_ fair use, training on PII without consent is _still_ problematic. It's a huge violation of privacy and adds all kinds of legal/regulatory/ethical risks that potential consumers of said models won't be on board with. The language and spirit of the law certainly hasn't caught up, but I feel like in some cases (unconsenting use of PII, medical information, etc), the laws and ethics of how such data is used is pretty well established.
  - lacker 3y ago
    AI systems are trained against private, PII, copyrighted data all the time without explicit consent. For example, consider the spellcheck in Google search. Every query you make will go into the training for that system, along with your preferred language and country of origin. You can certainly argue that generative AI systems are different than previous AI systems and should be treated differently. But the current situation is basically that you are allowed to train an AI on any data you have, regardless of copyright or consent. I wouldn't be surprised if that ends up being considered legally and ethically okay, because it's the status quo, and because it's hard to define "what counts as AI".
autoexec 3y ago
> If I send private data to Dropbox they can't send it to anyone for any reason, including "improving" their product, without my explicit and informed consent. I'm not sure how this is even debatable. It'd debatable because your data isn't "private" when you foolishly hand it over to some third party without encrypting it first and their policies say they can basically use it for anything as long as they can claim that it was "in furtherance of its legitimate interests in operating our Services and business". In fact their policy says they can update their policies any time they feel like it. Privacy policies aren't even legally binding. If you're in the US and didn't sign a contract with dropbox you have near-zero rights, and any attempt to assert whatever rights you think you have will require going to court which is basically a pay to win system and you'll be up against a company with billions in assets so good luck with that. Yes, it'd be a very shitty thing for dropbox to outright violate the trust you put in them, and it might be a terrible business decision that means no one ever trusts dropbox with their data again, but if they one day decided to go fully evil and start handing your data over to anyone willing to pay for it I doubt there'd be much of anything you could do about it. Don't put any data you care about in the cloud without locally backing up and encrypting it and you'll never have to worry about what the cloud provider does with it or who they give it to.
deleted 3y ago
[deleted]

by bambax 3y ago

schnable 3y ago

Exactly. It's all about who can see my sensitive data, period.

lukeschlather 3y ago

> If Dropbox wants to house models and offer RAG search themselves, to consenting users, that's one thing. Well, I'm a paying Dropbox customer, and I would not pay for this feature. I would like it if they encrypted my data in a way that made offering this sort of feature impossible. I do want my data recoverable, but the fact that they can offer this AI "feature" at all, it seems like they've made zero effort to prevent malicious internal employees or third parties from accessing my data.

hinkley 3y ago
It’s like when forgot my password features send you back your current password instead of a new temporary one. Great, I’m back in my account, but now I dread even being here. What other stupid shit are you doing?

Swizec 3y ago

> If Dropbox sends all data of all users to third parties without telling anyone before the fact, that's another thing If they've ever signed a BAA (business associate agreement) with any enterprise customers using Dropbox for documents bound by HIPAA, this would get them into a lot of trouble very quickly. The financial penalties are _high and per exposure per employee involved_. They also hit employees doing directly (if you disclose/share HIPAA info then you personally are liable). So I'm certain that even if they did share documents with undisclosed 3rd parties without notice, it wouldn't be "all". Enterprise data is likely safe. Those contracts get heavy scrutiny before signing.

blibble 3y ago

> Yet I believe OpenAI isn't using data from Dropbox to train their models without users' consent. why? they trained on my code without my consent, why is user data any different? training is either fair use or it isn't and high growth Silicon Valley companies aren't known for the adherence to the spirit of the law

vorticalbox 3y ago
Just out of interest I have a few questions. 1. How do you know for sure it was trained on your code? 1.1 if you saw it reproduce you code verbatim how do you know it didn't just hallucinate it ? 2. Was you code publicly available? 3. What licence was it under?
- spatley 3y ago
  Well Github says it out loud: “ GitHub Copilot is trained on all languages that appear in public repositories.” Note it says “public” and not “open source” https://docs.github.com/en/copilot/overview-of-github-copilot/about-github-copilot-individual# https://docs.github.com/en/copilot/overview-of-github-copilo...
d4mi3n 3y ago
Training against your code shouldn't be kosher if your code isn't open, you retain a copyright, and you didn't consent. Even if training on copyrighted, private code _was_ fair use, training on PII without consent is _still_ problematic. It's a huge violation of privacy and adds all kinds of legal/regulatory/ethical risks that potential consumers of said models won't be on board with. The language and spirit of the law certainly hasn't caught up, but I feel like in some cases (unconsenting use of PII, medical information, etc), the laws and ethics of how such data is used is pretty well established.
- lacker 3y ago
  AI systems are trained against private, PII, copyrighted data all the time without explicit consent. For example, consider the spellcheck in Google search. Every query you make will go into the training for that system, along with your preferred language and country of origin. You can certainly argue that generative AI systems are different than previous AI systems and should be treated differently. But the current situation is basically that you are allowed to train an AI on any data you have, regardless of copyright or consent. I wouldn't be surprised if that ends up being considered legally and ethically okay, because it's the status quo, and because it's hard to define "what counts as AI".

autoexec 3y ago

> If I send private data to Dropbox they can't send it to anyone for any reason, including "improving" their product, without my explicit and informed consent. I'm not sure how this is even debatable. It'd debatable because your data isn't "private" when you foolishly hand it over to some third party without encrypting it first and their policies say they can basically use it for anything as long as they can claim that it was "in furtherance of its legitimate interests in operating our Services and business". In fact their policy says they can update their policies any time they feel like it. Privacy policies aren't even legally binding. If you're in the US and didn't sign a contract with dropbox you have near-zero rights, and any attempt to assert whatever rights you think you have will require going to court which is basically a pay to win system and you'll be up against a company with billions in assets so good luck with that. Yes, it'd be a very shitty thing for dropbox to outright violate the trust you put in them, and it might be a terrible business decision that means no one ever trusts dropbox with their data again, but if they one day decided to go fully evil and start handing your data over to anyone willing to pay for it I doubt there'd be much of anything you could do about it. Don't put any data you care about in the cloud without locally backing up and encrypting it and you'll never have to worry about what the cloud provider does with it or who they give it to.

deleted 3y ago

[deleted]