Hacker News Reader

Comment by surrTurr | Hacker News Reader

If you call this "spying", you should read the TOS of the OpenAI API again. If you, as a "hacker", still use their API, it's your own fault:

> OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them. You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case. For details on data handling, visit our Platform Docs page.

Source: https://openai.com/enterprise-privacy

View on HN

It's still an exceptionally poor privacy policy compared to pre-LLM online services.

Compare with the Google Docs privacy policy, for example:

https://support.google.com/docs/answer/10381817?hl=en

> Google respects your privacy. We access your private content only when we have your permission or are required to by law.

I think it is reasonable to expect the same from LLM API providers. The fact that they all currently do mass surveillance on users is bad.

> only when we have your permission or are required to by law

That can be very vague. does TOS gave them the permission? Does law can eb interpreted to require them to check for CSAM and pirated material? What about access by Iran or North Korea agents? If you are pushing things to cloud, these questions will be asked.

Anyone who cares will heed this language and not use them in the first place. For everyone else, Google's reputation as a "secure" place to host your proprietary files, docs, and emails will be flushed away if they cooperate with (foreign, mostly) law enforcement or have such a glaring security vulnerability that allows an org's files to leak from Google servers.

Azure's TOS are different. You can also opt-out of data retention: https://learn.microsoft.com/en-us/legal/cognitive-services/o...

I'd assume Azure's TOS does not allow foreign secret services to use it for its operations. I remember TOS of iTunes mentioned you can't use it to build nuclear bombs. In that sense, there's no way that what Microsoft did was illegal.

It also lists "30-days retention window" for Asynchronous Abuse Monitoring.

Yes, but you can opt-out of the data retention and abuse monitoring if you go through a vetting process and are deemed low risk.

That is correct. The process is manual and definitely has humans in the loop. It is also required for every individual subscription in your account.

That’s the catch every little thing is a subscription on their platform.

It’s also not failure evident.

I’ve managed a very large tenant with a number of carve out T&C. I’m aware of at least a dozen times that settings reverted during upgrades or migrations. O365 is a huge service with a lot of humans and duct tape holding things together.

Unless you’re auditing them, you have no idea.

These are not all that unique and pretty common across all cloud services, GCP, AWS, Azure included. Especially in the spectrum of their ML/AI services.

I don't think these TOS are out of this world.

Reply on news.ycombinator.com