Hacker News Reader

Comment by cheshire_cat | Hacker News Reader

Do they train on your code that they read for context? Do they retain the code snippets you generate? Can't find any mention in regards to privacy in their copy.

View on HN

It’s opt-out for the free version: https://aws.amazon.com/codewhisperer/faqs/

https://docs.aws.amazon.com/codewhisperer/latest/userguide/s...

Hard to prove if they use it anyway

It's Amazon so assume that they do unless it's extremely clearly stated that they don't. And even then...

AWS is very stringent when it comes to user privacy.

AWS is probably very stringent on user privacy on the services that they specifically enter into HIPAA BAAs covering or which are associated with other data-security-compliance-related agreements or certifications.

Amazon as a whole has quite a history of using business data of people they are selling services to for their own purposes, and I wouldn’t put it past them with any AWS services not covered by the compliance agreements/certifications.

You certainly can’t rule out a large company making dumb moves but I have gotten the impression that they’re very hesitant to do anything which would make companies stop trusting them with private data, and the controls they have like allowing you to control the encryption policy for Code Whisperer data support that. It’d have to be worth a lot to make customers question whether it’s safe to use S3 (which uses the same mechanism).

Part of releasing AWS products to customers involves getting cleared by AppSec plus other compliance teams. The products are supposed to be ready months in advance before the AppSec and other teams start working on them.

For whatever reason I got flagged :')

Amazon and AWS have completely separate privacy/security teams and different ways of approaching it. _Every_ AWS service treats user data like radioactive material. If you're an AWS service and you're found to have a way for AWS employees to get access to customer data, that's a fast track for you and your managers to get an invite to a meeting with the CEO to explain how it happened, how you're going to fix it, and what you're going to do to make sure it never happens again. That's not an exaggeration, they take it very seriously.

Sounds like you trust what a big corporate entity with many arms whose primary purpose is to generate for shareholders

AWS is very different from Amazon in that regard.

I've used GCP and AWS for about equal time and Google was the one with several worrisome overreaches into customer's accounts moments. Meanwhile AWS actually lets you view and adjust the role and policy given to customer support on your account.

Fully aware AWS and amazon are different, but my point still stands IMO. Not sure why some people have so much trust in massive corporations who utlimately are all about making money for shareholders. For some people it's like supporting a sports team. My trust in them is one of caution and low expectations.

I said that because I worked at AWS, because I have seen the internal processes in action, and because I am aware that AWS has far more to lose by looking at customer data than they can gain.

Understand that as well, but its not always enough of a deterrent for some companies. And things change. Caution is a good thing IMO, e.g. don't lock yourself in so you're always capable of moving your solutions.

It's opt out.

"Hey Alexa, disable all microphones." "Sure." "Thanks Alexa." "You're welcome."...

The hardware mute on Amazon Alexa's is actually supposed to be a real mute, and on the Echo 5 we have, there's a hardware shutter over the camera.

Once the hardware mute is engaged, I've not had the Alexa reply.

Don't get me wrong, there's plenty of reasons to bash Amazon. I just don't count Alexa and privacy with mute among them.

Fair point, though I will say unless I look at the circuit myself and confirm the hardware mute switch is cutting an actual signal to/from the microphone, I won't fully trust it. Whether that matters is up for debate - I carry around a Google Pixel phone all day, and while I don't use any of the voice assistants, I also don't audit everything closely enough to guarantee nothing is spying on me randomly.

As for my joke in general - I guess my point, if I have to make one beyond making a joke, is that I don't really trust any company to do what they claim in all circumstances. Even if they have every intention of doing so, some bug or bad actor could compromise the intent - not saying it's identical, but look at the recent issue with Tesla camera pictures being shared. So if you're working on some mission critical or top secret code, I wouldn't trust _anything_ to be running or looking at it - not Copilot, CodeWhisperer, etc. etc.

Wireshark on your network. I know this was probably tongue in cheek, and not undeserved, but you can always prove this.

It was indeed a joke, but yeah, that's valid (and was how the Eufy issue was discovered IIRC).

Exactly this.

first thought I had was "they made it free to collect data since they don't own github or similar"

Reply on news.ycombinator.com