Remix clone Hacker News

new | show | ask | jobs Github

▲

namaria 16 hours ago

The audit performed by a private entity called "Insight Assurance"?

Why do you trust it?

▲

rovr138 16 hours ago | parent [-]

Oh, so now EVERYTHING is fake unless personally verified by you in a bunker with a Faraday cage and a microscope?

You're free to distrust everything. However, the idea that “I don’t trust it so it must be invalid” isn’t an solid argument. It’s just your personal incredulity. You asked if there’s any verification and SOC-2 is one. You might not like it, but it's right there.

Insight Assurance is a firm doing these standardized audits. These audits carry actual legal and contractual risk.

So, yes, be cautious. But being cautious is different than 'everything is false, they're all lying'. In this scenario, NOTHING can be true unless *you* personally have done it.

▲

namaria 16 hours ago | parent [-]

No, you're imposing a false dichotomy.

I merely said I don't trust the big corporation with a data based business to not profit from the data I provide it with in any way they can, even if they hire some other corporation - whose business is to be paid to provide such assurances on behalf of those who pay them - to say that they pinky promise to follow some set of rules.

▲

rovr138 16 hours ago | parent [-]

Not a false dichotomy. I'm just calling out the rhetorical gymnastics.

You said you "don’t trust the big corporation" even if they go through independent audits and legal contracts. That’s skepticism. Now, you wave it off as if the audit itself is meaningless because a company did it. What would be valid then? A random Twitter thread? A hacker zine?

You can be skeptical but you can't reject every form of verification. SOC 2 isn’t a pinky promise. It’s a compliance framework. This is especially required and needed when your clients are enterprise, legal, and government entities who will absolutely sue your ass off if something comes to light.

So sure, keep your guard up. Just don’t pretend it’s irrational for other people to see a difference between "totally unchecked" and "audited under liability".

If your position is "no trust unless I control the hardware," that’s fine. Go selfhost, roll your own LLM, and use that in your air-gapped world.

▲

namaria 15 hours ago | parent [-]

If anyone performing "rhetorical gymnastics" here is you. I've explained my position in very straightforward words.

I have worked with big audit. I have an informed opinion on what I find trustworthy in that domain.

This ain't it. There's no need to pretend I have said anything other than "personal data is not safe in the hand of corporations that profit from personal data".

I don't feel compelled to respond any further to fallacies and attacks.

	▲	rovr138 15 hours ago \| parent [-]
		You’re not the only one that’s worked with audits. I get I won’t get a reply, and that’s fine. But let’s be clear, > I've explained my position in very straightforward words. You never explained what would be enough proof which is how this all started. Your original post had, > Do you just completely trust them to comply with self imposed rules when there is no way to verify, let alone enforce compliance? And no. Someone mentioned they go through SOC 2 audits. You then shifted the questioning to the organization doing the audit itself. You now said > I have an informed opinion on what I find trustworthy in that domain. Which again, you failed to expand on. So you see, you just keep shifting the blame without explaining anything. Your argument boils down to, ‘you’re wrong because I’m right’. I also don’t have any idea who you are to say, this person has the credentials, I should shut up. So, all I see is the goal post being moved, no information given, and, again, your argument is ‘you’re wrong because I’m right’. I’m out too. Good luck.