Hacker News Reader

Comment by Sunspark | Hacker News Reader

Why should I believe that they're telling the truth? What's to stop any unethical company from doing it anyway, and not telling anyone?

There is no such thing as a training model auditor.

View on HN

Their consent order with the FTC also contains a prohibition against privacy misrepresentations, so it would probably get audited during their biennial assessments. For some unethical company that doesn't get regularly audited, yeah they'd probably get away with it unless it got leaked.

> Finally, the company must obtain biennial assessments of its security program by an independent third party, which the FTC has authority to approve, and notify the Commission if it experiences a data breach.

https://www.ftc.gov/news-events/news/press-releases/2020/11/...

> 22 years after the $63 billion Enron collapse, a key audit review board finds the industry in a ‘completely unacceptable’ state

https://fortune.com/2023/07/26/pcaob-audit-completely-unnacc...

>probably get audited during their biennial assessments

a lot of things can happen in 2 years though

The FTC probably can't fine them enough to make the training unprofitable.

Can't they? How much can they fine then?

Might me more of a "they won't" rather than a "they can't", regulatory capture and all.

You could say that about most ToS bits. A lot of them are hard to prove. This at least provides a potential legal remedy in the event that a) they are lying and b) we are able to determine that.

It's better than nothing (assuming you're still using Zoom).

At a certain point, you need some basic level trust do business with anybody. Regardless of what the ToS say, the company could do anything with the data. Even supposed E2E encryption has often been found to be either not really be encrypted, or unintentionally vulnerable.

Our whole system is based on assuming a degree of trust, based on both social norms and reputation of prior interaction, with a confidence of remedy in the case of a failure. If we really had to have much stronger confidence up-front in commercial interactions there would be a lot more friction and overhead in every transaction. Dealing with the occasional fraud seems like a better tradeoff.

The upside is too high to trust them, leaving aside any geopolitical stuff, it's just a juicy business.

New Zoom Subscription Tier:

Virtual agent with perfectly fine tuned domain-specific knowledge performs 99% as well as your sales/support person.

24/7/365

$400 per month

There are model risk analysis services among big-4 and boutique firms, and these fit into conventional audit processes as domain-experts. Similar services be bought apart from audit services as risk consulting from the same firms or alternately the familiar names in management consulting.

The danger of massive fines in Europe and being sued absolutely everywhere, I’d assume.

You just shouldn’t!

Reply on news.ycombinator.com