18 ms·

Good article overall, but I find the analogy between "my phone is eavesdropping on me" and "openai might be lying about how they use my data" somewhat flawed be

Good article overall, but I find the analogy between "my phone is eavesdropping on me" and "openai might be lying about how they use my data" somewhat flawed because there are robust checks on third-party apps accessing my iphone's microphone that have no equivalent when my data is handed to a third party in plain. Certainly for the layperson they may as well be the same thing, but that layperson is still being protected from the former. This might seem like splitting hairs, but I think it's extremely counterproductive to act like the battle for users' data privacy and sovereignty is lost just because most users can't tell the difference. I see this a lot from the other side: extremely cynical, at least somewhat tech-savvy people reacting to each new corporate abuse with an "old news" mentality as if we've already reached the endgame—if you haven't been using tails linux for at least a decade you may as well just zip up your home directory and email it to every shady tech corp and data broker you can find contact info for. These people ought to know better, and they ought to set a better example for those who don't. This inculcated helplessness definitely hurts trust, but it also gives people the impression that a better world isn't possible—that there aren't better and worse choices for who to trust with their data and privacy. This Dropbox snafu seems to be that mindset coming back around: users won't give a shit if we imply we're sending their private files to a third party without asking, right? Lunacy. Incidentally, I've had most of my data out of Dropbox for a while (in favor of a self-hosted solution), but yesterday was the kick in the ass I needed to cancel it for good. Thanks, Dropbox!

skywhopper 3y ago
I don’t think you’re splitting hairs here. You’re making a very good point. App access to the microphone is controlled by the OS and there are OS provided, user-accessible tools that make it clear what apps can use the microphone and when. Meanwhile cloud data access is completely on a “trust me” basis, and plenty of companies have been proven to have abused that trust.
simonw 3y ago
Yeah, I tried to touch on that analogy flaw in the article: > One interesting difference here is that in the Facebook example people have personal evidence that makes them believe they understand what’s going on. > With AI we have almost the complete opposite: AI models are weird black boxes, built in secret and with no way of understanding what the training data was or how it influences the model. Completely agree that our biggest threat right now is complacency. If people form incorrect mental models of what's going on and then shrug their shoulders and accept that's just how it is, we won't make much progress in improving the actual problems.
- deleted 3y ago
  [deleted]
mightybyte 3y ago
Can you give more detail about your self-hosted storage solution? I've wanted something like that for awhile.
- voltaireodactyl 3y ago
  FWIW, if you’re looking to enter that space as simply and reliably as possible, I would pick up a Synology machine in whatever size you need. They have some competition but remain the best mix of stability in hardware/software/price imo.
- caconym_ 3y ago
  I use a Synology NAS in my house with Syncthing running on it (for Dropbox-like directory sync) and Wireguard running on my router so that when I'm remote I can tunnel in and access all my services that way rather than opening ports individually (also great for mobile device ad blocking via my pi-hole). I'm luckily not behind a CGNAT, so no external proxy is required—just dynamic DNS. It was a fair amount of work to set it all up but it works flawlessly now, and I had fun. :) People who are really hardcore about data sovereignty would probably take issue with my choice of Synology, but you could roll your own if you prefer. Synology seems to have a decent record and reputation, and my experience with it has been pretty good overall. For backup, I'm currently using Synology's proprietary thing to do snapshots to Backblaze, and mirroring all my critical stuff to various other places. I'm planning to set up a Restic backup for more redundancy (and a bit of obscurity), and I would also like to figure out a cold backup scheme for the whole NAS though I haven't thought very hard about that yet.
  - aborsy 3y ago
    Why should someone hardcore on data sovereignty take issue with synology? It’s a device in your possession.
    - caconym_ 3y ago
      It's OEM-integrated hardware and (partially) proprietary software. Not something I particularly care about (at least, given their reputation), hence why I spent money on it and trust it with my data. But others might prefer to stay out of Synology's (or whoever's) garden altogether.
fasterik 3y ago
You can basically go in two directions with this. Invest the resources necessary to use the open source and self hosted tools, or settle for the convenience of proprietary services and be mindful about what you put in them. I use Dropbox, but everything I put in Dropbox is either encrypted or is something I wouldn't care about if it got leaked onto the open internet. As someone who has spent many hours of his life tinkering with self-hosted solutions, after a certain point I just decided that I wasn't deriving any real benefit from it and my time and energy would be better spent elsewhere.
- JohnFen 3y ago
  There's a third option here, too: don't use the tools.
- caconym_ 3y ago
  I appreciate the value of time, but the reality of Dropbox and similar commercial solutions is that they're constantly changing and forcing their customers to deal with those changes. A good self-hosted stack may take more up-front effort, but it's much less likely to change without your explicit buy-in.
JohnFen 3y ago
> it also gives people the impression that a better world isn't possible—that there aren't better and worse choices for who to trust with their data and privacy. I have no choice but to believe that a better world is possible. The current state of things isn't tolerable, and if tomorrow can't be better then what's the point of anything? Also, I'm sure that there are better and worse choices for who to trust with data and privacy -- but it's literally impossible for me to know who that would be (or if anybody is "trustworthy" in a broad sense), so I have to work on the assumption that nobody can be trusted. I want to be less cynical, but the way things have gone over the last decade or two makes cynicism look entirely justified. Is my attitude incorrect? If so, how can I correct it?
- caconym_ 3y ago
  > Also, I'm sure that there are better and worse choices for who to trust with data and privacy -- but it's literally impossible for me to know who that would be (or if anybody is "trustworthy" in a broad sense), so I have to work on the assumption that nobody can be trusted. I think it's very possible to get a decent sense of who cares more and who cares less. For instance, look at Apple's recent pushback against scanning private user data for CSAM, and compare that with the recently publicized case of a guy having his Google account permanently closed (and being referred to the police) because he took pictures of his baby to send to a pediatrician. "Normies" think these companies are the same, that they're all selling your data and that trusting one is just as bad as trusting the other. If we can chip away at that misapprehension, maybe said normies will start giving more of their money to companies that do a better job keeping private data private, and maybe that will drive long-term trends in the market. Or maybe not! Things are bad, I agree. But I still don't believe everything is equally bad everywhere. I don't believe it's all over.
  - JohnFen 3y ago
    > look at Apple's recent pushback against scanning private user data for CSAM I don't think that's a good example, because Apple was very much in favor of client-side scanning until they encountered a popular uproar about it. My impression of Apple is that they're very sensitive to privacy intrusions by anyone who isn't named "Apple".

skywhopper 3y ago

I don’t think you’re splitting hairs here. You’re making a very good point. App access to the microphone is controlled by the OS and there are OS provided, user-accessible tools that make it clear what apps can use the microphone and when. Meanwhile cloud data access is completely on a “trust me” basis, and plenty of companies have been proven to have abused that trust.

simonw 3y ago

Yeah, I tried to touch on that analogy flaw in the article: > One interesting difference here is that in the Facebook example people have personal evidence that makes them believe they understand what’s going on. > With AI we have almost the complete opposite: AI models are weird black boxes, built in secret and with no way of understanding what the training data was or how it influences the model. Completely agree that our biggest threat right now is complacency. If people form incorrect mental models of what's going on and then shrug their shoulders and accept that's just how it is, we won't make much progress in improving the actual problems.

deleted 3y ago
[deleted]

mightybyte 3y ago

Can you give more detail about your self-hosted storage solution? I've wanted something like that for awhile.

voltaireodactyl 3y ago
FWIW, if you’re looking to enter that space as simply and reliably as possible, I would pick up a Synology machine in whatever size you need. They have some competition but remain the best mix of stability in hardware/software/price imo.
caconym_ 3y ago
I use a Synology NAS in my house with Syncthing running on it (for Dropbox-like directory sync) and Wireguard running on my router so that when I'm remote I can tunnel in and access all my services that way rather than opening ports individually (also great for mobile device ad blocking via my pi-hole). I'm luckily not behind a CGNAT, so no external proxy is required—just dynamic DNS. It was a fair amount of work to set it all up but it works flawlessly now, and I had fun. :) People who are really hardcore about data sovereignty would probably take issue with my choice of Synology, but you could roll your own if you prefer. Synology seems to have a decent record and reputation, and my experience with it has been pretty good overall. For backup, I'm currently using Synology's proprietary thing to do snapshots to Backblaze, and mirroring all my critical stuff to various other places. I'm planning to set up a Restic backup for more redundancy (and a bit of obscurity), and I would also like to figure out a cold backup scheme for the whole NAS though I haven't thought very hard about that yet.
- aborsy 3y ago
  Why should someone hardcore on data sovereignty take issue with synology? It’s a device in your possession.
  - caconym_ 3y ago
    It's OEM-integrated hardware and (partially) proprietary software. Not something I particularly care about (at least, given their reputation), hence why I spent money on it and trust it with my data. But others might prefer to stay out of Synology's (or whoever's) garden altogether.

fasterik 3y ago

You can basically go in two directions with this. Invest the resources necessary to use the open source and self hosted tools, or settle for the convenience of proprietary services and be mindful about what you put in them. I use Dropbox, but everything I put in Dropbox is either encrypted or is something I wouldn't care about if it got leaked onto the open internet. As someone who has spent many hours of his life tinkering with self-hosted solutions, after a certain point I just decided that I wasn't deriving any real benefit from it and my time and energy would be better spent elsewhere.

JohnFen 3y ago
There's a third option here, too: don't use the tools.
caconym_ 3y ago
I appreciate the value of time, but the reality of Dropbox and similar commercial solutions is that they're constantly changing and forcing their customers to deal with those changes. A good self-hosted stack may take more up-front effort, but it's much less likely to change without your explicit buy-in.

JohnFen 3y ago

> it also gives people the impression that a better world isn't possible—that there aren't better and worse choices for who to trust with their data and privacy. I have no choice but to believe that a better world is possible. The current state of things isn't tolerable, and if tomorrow can't be better then what's the point of anything? Also, I'm sure that there are better and worse choices for who to trust with data and privacy -- but it's literally impossible for me to know who that would be (or if anybody is "trustworthy" in a broad sense), so I have to work on the assumption that nobody can be trusted. I want to be less cynical, but the way things have gone over the last decade or two makes cynicism look entirely justified. Is my attitude incorrect? If so, how can I correct it?

caconym_ 3y ago
> Also, I'm sure that there are better and worse choices for who to trust with data and privacy -- but it's literally impossible for me to know who that would be (or if anybody is "trustworthy" in a broad sense), so I have to work on the assumption that nobody can be trusted. I think it's very possible to get a decent sense of who cares more and who cares less. For instance, look at Apple's recent pushback against scanning private user data for CSAM, and compare that with the recently publicized case of a guy having his Google account permanently closed (and being referred to the police) because he took pictures of his baby to send to a pediatrician. "Normies" think these companies are the same, that they're all selling your data and that trusting one is just as bad as trusting the other. If we can chip away at that misapprehension, maybe said normies will start giving more of their money to companies that do a better job keeping private data private, and maybe that will drive long-term trends in the market. Or maybe not! Things are bad, I agree. But I still don't believe everything is equally bad everywhere. I don't believe it's all over.
- JohnFen 3y ago
  > look at Apple's recent pushback against scanning private user data for CSAM I don't think that's a good example, because Apple was very much in favor of client-side scanning until they encountered a popular uproar about it. My impression of Apple is that they're very sensitive to privacy intrusions by anyone who isn't named "Apple".