Hacker News Reader

Comment by thomastjeffery | Hacker News Reader

If it was totally open-source, if I could easily make it run a different binary, and if I could change the wake-word, it might become appealing.

Unfortunately, Alexa, Google Home/Assistant, Cortana, and Siri each fit none of those requirements.

I hear Mozilla is working on a speech recognition library. That might be workable.

It's crazy to me how much trust some people have in these systems. People on the whole seem to have totally given up on the idea of digital privacy, and I find that very concerning.

View on HN

It's the Privacy v. Convenience trade off. The conveniences are promoted, the privacy implications shrugged off, and in the end you pay someone money to invade your home 24 hours a day.

It's a simple but scary formula that doesn't make me optimistic for the future.

I think the biggest ways we can combat this formula are:

1. Fight DRM. DRM is a pipe-dream enforced by law (DMCA Section 1201

2. Promote Free Software. Proprietary software does not deserve our data.

You forgot “don’t use”.

I don’t use any assistant apps. I can’t possibly imagine how my life would be better if I did.

Unfortunately, "don't use" isn't a practical or effective solution.

Boycotts only work if a significant group is boycotting.

Neither do I. Doesn't stop those around me.

At some point we will have to embrace full loss of privacy. Today, only the rich and powerful have mass surveillance capabilities.

But if we embrace surveillance, we can give that power to everyone. It's much harder to do selective enforcement when the same strategies can be turned on the prosecutor.

> we can give that power to everyone

Just like how "voting" gave everyone useful legislative influence? A society where everyone reports on each other is the canonical model for dystopia. Tom Scott's "Oversight"[1] is warning, not a recommendation.

> the same strategies can be turned on the prosecutor.

Having evidence about a prosecutor's misdeeds doesn't mean you have the power to enforce anything. We already have police walking away from from video evidence of murder without charges. That will change with a lot more active political involvement. More surveillance wouldn't help.

[1] https://www.youtube.com/watch?v=RIuf1V1FhpY

> A society where everyone reports on each other is the canonical model for dystopia.

Or: Russian/Chinese Communism.

I disagree with this solution. Privacy has utility and when you give it up you do lose something. Even if we give it up to each other we are still in a worse place.

You may disagree with the solution, but I don't see how privacy can be preserved given the technology we are building. Cameras getting smaller, and better. Microphones getting smaller, and better. Drones getting smaller and better. And all cheaper as well. Storage and search is also getting better and cheaper.

The tide may be far away, but it's rushing in and you can't stop it. We must embrace the water.

> We must embrace the water.

No.

Just because it seems inevitable does not mean I must embrace it. I refuse to embrace it.

While the things that are used to perform secret surveillance improve, the things that are used to uncover secret surveillance also improve.

I am not going to willingly give up my privacy.

Giving up a right is not an effective way of preventing it from being stolen. Technology is continually improving but we still have a say in how it is used. I have no respect for this or any other defeatist strategy.

> At some point we will have to embrace full loss of privacy.

At some point we will have to embrace full loss of all rights. Today, only the rich and powerful can literally get away with murder...OK, that's stupid and over-dramatic, but only a little more absurd than what you said.

Living in a panopticon would just make society into more of a jail than it already is. That's not something we should embrace, even if it's difficult to fight against.

An invasion is unwelcome. More accurately people are paying for the device and inviting the company into their home. As long as the guest does not break the trust of the host, they will be allowed to stay.

This is the biggest problem with the website: shodan.io. They're always there to report the slightest gap in a system.

To me it's like someone with a camera attached to their shoe to look up ladies skirts. It's creepy and should be illegal. (Of course, they put in under the label: it's publicly available information... but anyone with privacy concerns will realise that it's not true)

Whenever you have a 'smart' device, there'll always be someone banging away looking for holes in it, especially with shodan.io.

To me, it seems to be the biggest perpetrator in enabling privacy loss.

Edit: typo.

Ah yes, the terrifying privacy implications of Alexa. Now Google and Amazon know I check the weather every morning.

Oh, the dystopia.

> Ah yes, the terrifying privacy implications of Alexa. Now Google and Amazon know I check the weather every morning.

More realistically and already in the wild: ad fingerprinting.

https://arstechnica.com/information-technology/2017/05/there...

They also know the argument between you and your partner, the private secret a friend asked you to share with no one, when you're not going to be home, etc. etc.

Is there actual evidence of this? Tell me: do you also decline to have a cell phone in your pocket?

I want actual evidence of the contrary.

With a closed-source platform, I can't have that.

I have a cell-phone in my pocket, and I am concerned about the privacy implications. Android is free software, but the driver blobs are not. I do hate that I am compromising for that. Hopefully, there will be more affordable options like the librem phone in the near future.

Here is the best evidence: http://www.cnn.com/2017/03/07/tech/amazon-echo-alexa-bentonv...

How so if they're not recording all the time?

How can you be sure? Maybe you have the source code?

Well, for one, there's the power switch on the side.

And the power switch on the power strip it's attached to if, for some reason, I decide to suspect that the hard switch on the device is a lie.

If you're worried enough to turn it off sometimes, why not just...not have one in the first place?

> If you're worried enough to turn it off sometimes, why not just...not have one in the first place?

The same reason why the fact that I'm worried enough sometimes (e.g., major lightning storms) to unplug various electronics does not mean I choose not to own such electronics in the first place: sometimes isn't all the time, and both the costs of potential vulnerability and the benefit of features (and thus the balance between those two things) can shift with context.

Though, in reality, I'm never actually that worried about my Google Home, I just recognize that this there are adequate existing hardware-based solutions that, should I be concerned at some time—which I can imagine being, though I haven't been—an adequate mitigation exists that doesn't involve not possessing the device.

To me, the difference between the lightning scenario and a digital assistant, is that in the former scenario, I'm protecting the device (and my home) by disconnecting it, but in the latter scenario, I'm protecting myself from the device. It's something inherent to the nature of the device that I'm trying to avoid. I don't feel like those are comparable situations.

Source to support?

You may enjoy George Orwell’s 1984. You can order it through your telescreen.

Just mentioned this above, but you should check out https://mycroft.ai/. It is a totally open source AI/assistant system.

Tried it. You need an account with MyCroft to set up your device, and it uses Googles STT API. You can use CMU Sphinx to backend the STT...but it sucks.

So nevermind privacy, the stupid thing needs connectivity all the time. Might as well go with DragonDictate.

There's no practical difference from carrying a cell phone with you everywhere.

You can disable the voice assistant on a cell phone and many phones come with it disabled by default. It is up to you to have it on.

How do you trust that it’s actually disabled?

You can't completely. Android is free software, but the driver blobs are not, and are often known to have security flaws.

It's not something that I am OK with. It's a compromise.

I am excited for the librem phone[0], but I can't afford something like that at the moment.

[0]https://puri.sm/shop/librem-5/

Run a custom ROM and monitor network connections. Don't trust, verify.

Good luck verifying that radio chip.

Well, if you can verify the data being fed into the chip by the software that you can verify...

I suppose you could use a dedicated 4G modem and connect a WiFi-only tablet to that.

The 3G/4G modem is a different chip with its own ARM CPU. Android and iOS communicate with it over a limited AT-API.

How do you know it is disabled? Plus far easier to have additional rogue software on a phone versus one of these smart speakers.

at least with a cellphone you can use AOSP.

And then add a few proprietary kernel modules so stuff actually works.

You can use the Alexa API with your own binary (on a raspberry pi or whatever) and set the wake word however you want (open source code provided by Amazon).

Good for people who know how to set that up.

They are trying to crowd source the data: https://voice.mozilla.org

Reply on news.ycombinator.com