Hacker News Reader

Comment by gumballindie | Hacker News Reader

Software companies must be leaking code on a massive scale right now.

Some even upload all their conversations and confidential internal documents to Microsoft 365!

Which works perfectly fine until someone leaks the fact that NSA have full access to those documents, and occasionally will provide help to a few US companies that are seen as important to the nation.

Do you have any example of your claim about providing help?

This has been valid even decades before internet took over the world, I recall quite a few articles listed well known cases some years ago. Sure it wont push for some small startup but big corporations, sales of commercial planes, military equipment contracts and similar stuff for billions and more?

CIA/NSA would be failing at its core real mission if they didnt help US interests when they see an opportunity. And with us-based cloud they dont need to hack anything remote, just fill another form and go again in.

Makes me think, having strong privacy laws like ie in Swtzerland is a massive win for given country and its citizens in long term.

They did in the past why not now?

https://en.m.wikipedia.org/wiki/ECHELON#Concerns

Siemens and some other German majors claimed the NSA stole thier trade secrets related to wind turbines and gave them up some American companies. I think they claimed it was done via wire tap.

I'm not sure if this claim was ever validated but it seems wild those fairly boring companies would come out with it over nothing, whereas it is related to of the US services stated mission.

US government access to thier companies customers files has been a compliance issue in Europe for a while because it is hard to claim GDPR compliance if your vendor might be required to leak user data outside the judicial system. This is why privacy shield treaty was needed.

It is hopelessly naive to question this, however some random documented examples in recent times: The NSA got the german BND to spy on european company Airbus. [1] Then there was the Snowden leaks that revealed for example that the NSA was spying on an Brazilian oil company. [2] Then there is the well known case of Shell infiltrating the Nigerian government who then asked the US to spy for them on rival company Gazprom, which was revealed by the diplomatic cable leaks. [3]

[1] https://www.bbc.com/news/world-europe-32542140

[2] https://www.theguardian.com/world/2013/sep/09/nsa-spying-bra...

[3] https://www.theguardian.com/business/2010/dec/08/wikileaks-c...

Even if you do O365 with EU hosted instances?

Obviously Yes.

No, the US government is well known for following the letter of the law when it comes to domestic and international spying.

Some people upload their entire private lives, personal and family photos to iCloud. Several celebrities were target of iCloud leaks and their nudes ended up into 'the fappening'.

Microsoft so far hasn't been hacked.

Wonder what the searches reveal about someone? What's worse: search history or DNS logs? I guess it's pretty moot if it's all going to the googs with their DNS and Website Analytics + Ad networks.

There is a difference between me choosing where i upload my own data vs a bank worker uploading sensitive data all over the web. There are contractual agreements at least in the uk that customer data would not be sent or stored in the us for instance.

>Microsoft so far hasn't been hacked.

How do you know?

Any hacker group would love to boost about it for the street cred or try to monetize it if they ever did, or there would be at least some chatter on the darknet about it which would be reported on in the media anyway.

Nation states wouldn't, but it's safe to assume powerful nation states are already in every cloud provider, at least the US glowy boys anyway according to Snowden.

> Any hacker group would love to boost about it for the street cred or try to monetize it if they ever did, or there would be at least some chatter on the darknet about it which would be reported on in the media anyway.

And you are sure no hacker group has boasted, anywhere on the darknet, about hacking Microsoft? And even if that were true, you take that as strong evidence that Microsoft has not been hacked?

Your second paragraph sounds more like "of course it's hacked"

LOL, wut

https://www.bleepingcomputer.com/news/microsoft/lapsus-hacke...

Some even upload their credit card numbers to Amazon.

Security and privacy are different things.

And to Google and Amazon and GitHub and Slack and 100 other SaaSs. Not sure why openai is supposed to be more of a concern.

Because whatever you send to ChatGPT may be future training data for their AI model. Mixing up your data with other customer's data is not really part of Slack's business (yet?).

You can opt out. See https://help.openai.com/en/articles/5722486-how-your-data-is...

> When you use our non-API consumer services ChatGPT or DALL-E, we may use the data you provide us to improve our models. You can switch off training in ChatGPT settings (under Data Controls) to turn off training for any conversations created while training is disabled or you can submit this form. Once you opt out, new conversations will not be used to train our models.

They just added the opt-out last week. I think they removed restrictions on using the output as well, but I haven’t gone back to look for details.

True, but ChatGPT on Azure OpenAI never did: https://learn.microsoft.com/en-us/legal/cognitive-services/o...

Not all SaaS companies have security postures equivalent to Amazon/Google/Github/MS. Most SaaS have a fraction of a budget as compared tech giants to deal with security and privacy regulations.

Because OpenAI's product is a Chatbot. If somehow your data becomes part of the model, everyone can ask for it.

Not sure why you are attempting to conflate a LLM product offering vs. these other companies (except maybe GitHub copilot which only has public repos as training data). What you enter into ChatGPT becomes part of its training data unless you use the extremely recently available opt-out option. Once it becomes part of the training data it will end in many outputs to entities beyond your control. OpenAI doesn't have enough safeguards to prevent every single instance of such leaks and it is infeasible for them to implement safeguards for every single instance of such leaks.

Not following. Some eu data are not meant to be stored on aws zones outside the eu and if and where that is a concern aws is not used at all. Neither is azure or google cloud. Those “100 other saas” are meant to follow clear rules on how data is processed else they get stricken by gdrp.

Not only code, I have heard horror stories of employees uploading regulated customer data to Open AI.

There’s a ~3000 word prompt limit so while it’s bad whole user datasets are unlikely to have been uploaded… the issue will come when ChatGPT work out how to do live training from prompts and other user interactions, I suppose it will be filtered but nothing is 100%.

Doesn't necessarily apply to data being processed with plugins. The "Code Interpreter" plugin lets you upload files up to 100 MB for use by AI-generated Python scripts; see https://www.oneusefulthing.org/p/it-is-starting-to-get-stran... for examples (including useful output from vague prompts like "please characterize this dataset", at least if you get lucky).

There was a "Show HN" post on here that was planning on using this type of AI to help doctors, basically letting them pipe their patients' medical data into an online AI chat.

The way basic privacy and secrecy is ignored in this space is staggering.

The whole space is built around it. The reason is simple. These machine learning systems need massive amounts of data to calibrate for accuracy. They are not intelligent to somehow learn on their own. So machine learning companies have figured they can do an aggressive marketing campaign to make people think these are intelligent and uncontrollable to mask their never ending hunger for our data, hoping everyone is ignorant enough not to catch on.

What remains to be seen is whether we come back to our senses soon enough.

A lot of “experts” working in ai are warning about dangers but what they omit telling is that it’s the humans who own ai that are dangerous.

That’s just plain wrong. Any AI expert worth their salt will tell that the humans who own, control and operate the AI is the primary danger, at least the way it works today.

Whole city in Japan: https://www.japantimes.co.jp/news/2023/04/20/national/chatgp...

However, Samukawa offered assurances that Yokosuka intends to use the tool in line with OpenAI’s typical security policy.

Code and data. I know people putting company data in there.

Always have been. I've been working on healthcare project, they haven't even shared all the repos with us, for data leakage concern, but they were using free web tools to format jsons and things like that. Boggles the mind.

ChatGPT: “That’s not an abstraction, it’s an abomination”

Reply on news.ycombinator.com