Hacker News Reader

Yeah, I tried to touch on that analogy flaw in the article:

> One interesting difference here is that in the Facebook example people have personal evidence that makes them believe they understand what’s going on.

> With AI we have almost the complete opposite: AI models are weird black boxes, built in secret and with no way of understanding what the training data was or how it influences the model.

Completely agree that our biggest threat right now is complacency. If people form incorrect mental models of what's going on and then shrug their shoulders and accept that's just how it is, we won't make much progress in improving the actual problems.

> it also gives people the impression that a better world isn't possible—that there aren't better and worse choices for who to trust with their data and privacy.

I have no choice but to believe that a better world is possible. The current state of things isn't tolerable, and if tomorrow can't be better then what's the point of anything?

Also, I'm sure that there are better and worse choices for who to trust with data and privacy -- but it's literally impossible for me to know who that would be (or if anybody is "trustworthy" in a broad sense), so I have to work on the assumption that nobody can be trusted.

I want to be less cynical, but the way things have gone over the last decade or two makes cynicism look entirely justified.

Is my attitude incorrect? If so, how can I correct it?

> Also, I'm sure that there are better and worse choices for who to trust with data and privacy -- but it's literally impossible for me to know who that would be (or if anybody is "trustworthy" in a broad sense), so I have to work on the assumption that nobody can be trusted.

I think it's very possible to get a decent sense of who cares more and who cares less. For instance, look at Apple's recent pushback against scanning private user data for CSAM, and compare that with the recently publicized case of a guy having his Google account permanently closed (and being referred to the police) because he took pictures of his baby to send to a pediatrician.

"Normies" think these companies are the same, that they're all selling your data and that trusting one is just as bad as trusting the other. If we can chip away at that misapprehension, maybe said normies will start giving more of their money to companies that do a better job keeping private data private, and maybe that will drive long-term trends in the market.

Or maybe not! Things are bad, I agree. But I still don't believe everything is equally bad everywhere. I don't believe it's all over.

> look at Apple's recent pushback against scanning private user data for CSAM

I don't think that's a good example, because Apple was very much in favor of client-side scanning until they encountered a popular uproar about it.

My impression of Apple is that they're very sensitive to privacy intrusions by anyone who isn't named "Apple".

> because Apple was very much in favor of client-side scanning until they encountered a popular uproar about it.

I always find it curious when I see "company changes plans due to consumer feedback" framed as a bad thing rather than a good thing, especially when they are one of a field of companies that are largely already doing the thing people were upset about. Personally, I think it's great when a company has a pragmatic motive to act in the consumer's interest rather than (or possibly in addition to) an idealistic motive, because a pragmatic motive is much more likely to stand the test of time.

So, I disagree with you that it's not a good example. In fact, I think it's a great example of one of these big platforms being materially better wrt. consumer privacy than their competition. Frankly, I think your "impression of Apple [...] that they're very sensitive to privacy intrusions by anyone who isn't named 'Apple'" is exactly what I was talking about in my first comment in this thread: a cynical, unsubstantiated implication that all these platforms are equally as bad as each other, and that we've already lost the battle in the consumer space.

> I always find it curious when I see "company changes plans due to consumer feedback" framed as a bad thing rather than a good thing

I wasn't framing it that way at all. Being responsive is a good thing. But in the context of this issue, that they did so means they're responsive to outcry. It doesn't seem to me to be an indication that they care more about privacy issues generally.

> implication that all these platforms are equally as bad as each other

As I stated in an earlier comment, I don't think this at all and certainly wasn't intending to imply it. But just because one company is better than another on these issues doesn't mean that company is good on these issues.

I don’t think you’re splitting hairs here. You’re making a very good point. App access to the microphone is controlled by the OS and there are OS provided, user-accessible tools that make it clear what apps can use the microphone and when.

Meanwhile cloud data access is completely on a “trust me” basis, and plenty of companies have been proven to have abused that trust.

You can basically go in two directions with this. Invest the resources necessary to use the open source and self hosted tools, or settle for the convenience of proprietary services and be mindful about what you put in them. I use Dropbox, but everything I put in Dropbox is either encrypted or is something I wouldn't care about if it got leaked onto the open internet. As someone who has spent many hours of his life tinkering with self-hosted solutions, after a certain point I just decided that I wasn't deriving any real benefit from it and my time and energy would be better spent elsewhere.

There's a third option here, too: don't use the tools.

I appreciate the value of time, but the reality of Dropbox and similar commercial solutions is that they're constantly changing and forcing their customers to deal with those changes. A good self-hosted stack may take more up-front effort, but it's much less likely to change without your explicit buy-in.

Can you give more detail about your self-hosted storage solution? I've wanted something like that for awhile.

FWIW, if you’re looking to enter that space as simply and reliably as possible, I would pick up a Synology machine in whatever size you need. They have some competition but remain the best mix of stability in hardware/software/price imo.

I use a Synology NAS in my house with Syncthing running on it (for Dropbox-like directory sync) and Wireguard running on my router so that when I'm remote I can tunnel in and access all my services that way rather than opening ports individually (also great for mobile device ad blocking via my pi-hole). I'm luckily not behind a CGNAT, so no external proxy is required—just dynamic DNS. It was a fair amount of work to set it all up but it works flawlessly now, and I had fun. :)

People who are really hardcore about data sovereignty would probably take issue with my choice of Synology, but you could roll your own if you prefer. Synology seems to have a decent record and reputation, and my experience with it has been pretty good overall.

For backup, I'm currently using Synology's proprietary thing to do snapshots to Backblaze, and mirroring all my critical stuff to various other places. I'm planning to set up a Restic backup for more redundancy (and a bit of obscurity), and I would also like to figure out a cold backup scheme for the whole NAS though I haven't thought very hard about that yet.