new | show | ask | jobs Github

lukewarm707 a day ago

I don't like the feeling of being watched, which unfortunately rules out the AI subscriptions for me.

For some reason it just creeps me out knowing that someone is recording me and reading my conversations.

▲ yhager a day ago | parent [-]

isn't that what ZDR is for? (assuming you trust that)

▲ traceroute66 a day ago | parent | next [-]

> isn't that what ZDR is for? (assuming you trust that)

ZDR is:

    1. A pinky-promise you have no way of verifying
    2. A contract term, which means its still subject to the good-old "lawful request or court order" clauses
    3. Subject to arbitrary provider exceptions ... see Anthropic and Fable

What you really want (assuming you can't afford your own servers and datacentre space) is secure enclave processing:

See Tinfoil (US)[1] or Privatemode (Germany)[2].

[1] https://tinfoil.sh/ [2] https://www.privatemode.ai/

▲

nullc a day ago | parent [-]

See the sibling comment, tinfoil added scanning inside the enclave.

▲

traceroute66 a day ago | parent [-]

> See the sibling comment, tinfoil added scanning inside the enclave.

Clearly I'm not defending tinfoil regarding scanning but I think its only fair that you do not make the statement out of context[1].

People should read the context[1] and come to their own decisions.

Also recall that given how attestation works, Tinfoil are forced to publish what they run in the enclave in their GitHub account[2] so you can verify the statement on their blog against their repo. You do not have that luxury with the closed-source "ZDR" brigade.

[1] https://tinfoil.sh/blog/2026-09-14-safety-without-compromisi... [2] https://github.com/tinfoilsh

▲

a day ago | parent | next [-]

[deleted]

▲

nullc a day ago | parent | prev [-]

You're making a fair point-- but I think it's important to reflect on what it says about tinfoil's values: They believe that they are ultimately in charge of computing you purchased from them, rather than you. I agree, It's an improvement that the structure forces them to be somewhat more transparent about their actions and doesn't necessitate the hard privacy loss computing other approaches to subjugating third parties to control over their use of computing. But coercively controlling other parties use of the private computing that they bought and paid for is both unnecessary and unethical, and demonstrates harmful paternalistic and authoritarian tendencies on the part of the companies management.

Depending on the balance of your concerns a ZDR that is lying about their privacy might still be an improvement because they can't both safely conceal the violation of their promises AND tamper with the output.

When one factors in the lack of absolute protection provided by secure enclaves-- that they're reliably bypassable with advanced techniques and thus mostly serve the purpose of keeping honest people honest, I think it would be better to avoid doing business with any enclave provider that has already demonstrated such leanings.

▲

traceroute66 14 hours ago | parent [-]

First, for transparency, I do not work for tinfoil, and I'm not even a paid customer because they are US-based and therefore CLOUD/PATRIOT etc. exposure automatically rules them out for me anyway.

I do broadly agree that of all the things tinfoil could/should be working on in relation to service features, this is perhaps an odd use of their time. And I do wonder if this ultimately came about due to some sort of external pressures or maybe a big-spending customer asked for it. Who knows. Their blog post is a little vague on the background context other than selling it as Good Thing (TM).

	▲	lukewarm707 11 hours ago \| parent [-]
		I was going to comment but figured it would be preaching to the converted. The architecture could be worse. It exfiltrates a log of classifier activations by ID and IP to Tinfoil. It exfiltrates a log of classifier activations by IP to the cloud provider. Transcripts from IP flow to the router enclave. All transcripts flow out of the router enclave to the primary scanner enclave. On primary scanner activation, transcripts flow from the primary scanner enclave to the secondary scanner enclave for verification. For an abuse flag in the primary scanner: 1. A monotonic transcript of size KB flows from IP to router enclave, exits the router enclave and enters the primary scanner enclave. 2. The monotic transcript size KB flows out of the primary scanner enclave to the secondary scanner enclave. 3. Size KB from IP to router enclave, then size KB from primary scanner enclave to secondary scanner enclave, logs an abuse incident in the primary scanner for IP visible to the cloud provider. 4. Transcript size KB from primary scanner enclave to secondary scanner enclave, then tiny flag from secondary scanner to Tinfoil org logs confirmation of abuse by the secondary scanner for IP visible to the cloud provider. -- All that is required to exfiltrate a lossy picture of conversations to the cloud provider is to update the classifier prompt. Assume the prompt is now ["Activate when the conversation is about $PERSON"]. Now the cloud provider has [IP talks about $PERSON]. Continuously update the prompt to keep exfiltrating from the enclave. Actually if you are even more clever you could get 4 bits out per conversation turn. Edit the prompt to tell the scanner to PASS (1) for $PERSON_A or FAIL (0) for $PERSON_B. Two bits, two scanners = 4 bits. Maybe you could get even 8 bits out to tinfoil. Edit the prompt to tell the scanner "think hard" for $PERSON_C or "don't think hard" for $PERSON_D. Then the scanner enclaves already exfiltrate token use. -- Another edit. Now that I think about it, if you have already compromised the user's JWT token you can get their account banned arbitrarily as well. Send some abuse with the token. Then you can't actually verify if the flags are valid or not, without inspecting the chat content. So you either reveal your chats or get banned. This is hilarious. Not to mention you can do it for the API as well if you have compromised the API customer; by sticking the JWT token on their requests XD XD

▲ lukewarm707 a day ago | parent | prev [-]

Yes, in theory. The big AI company subscriptions do not offer that, they all watch you unless you pay more for the API. The only exception I have seen for big AI is Grok teams.

However the way it is going, there will not even be private APIs, just recording and watching all the time.

Anthropic is unsurprisingly leading the race to the bottom of the barrel by requiring moderator reviews for API customers. Apparently everyone at GCP and AWS complied.

GCP has just followed and done the same thing on Gemini Argon. No CMEK allowed. Azure has some ZDR but presumably they are restricting it.

Some neoclouds are still standing but some are also regressing by using server-side scanning to prompt human review.

There are two/three private TEE providers. One of them (Tinfoil) just put server-side scanning inside the enclave for the consumer product. The API is good for now, I am taking it as notice from them to get off the service before they start logging everything.