How would you explain it in a way that is both nontechnical, accurate and differentiates yourself from all the other companies that are not doing something even remotely similar? I am asking genuinely because from the perspective of a user that decided to trust the company, zero-access is functionally much closer to e2ee than it is to "regular services", which is the alternative.
loudwhisper
joined 2 years ago
Scribe can be local, if that's what you are referring to.
They also have a specific section on it at https://proton.me/support/proton-scribe-writing-assistant#local-or-server
Also emails for the most part are not e2ee, they can't be because the other party is not using encryption. They use "zero-access" which is different. It means proton gets the email in clear text, encrypts it with your public PGP key, deletes the original, and sends it to you.
See https://proton.me/support/proton-mail-encryption-explained
The email is encrypted in transit using TLS. It is then unencrypted and re-encrypted (by us) for storage on our servers using zero-access encryption. Once zero-access encryption has been applied, no-one except you can access emails stored on our servers (including us). It is not end-to-end encrypted, however, and might be accessible to the sender’s email service.
Over the years I've heard many people claim that proton's servers being in Switzerland is more secure than other EU countries
Things change. They are doing it because Switzerland is proposing legislation that would definitely make that claim untrue. Europe is no paradise, especially certain countries, but it still makes sense.
From the lumo announcement:
Lumo represents one of many investments Proton will be making before the end of the decade to ensure that Europe stays strong, independent, and technologically sovereign. Because of legal uncertainty around Swiss government proposals(new window) to introduce mass surveillance — proposals that have been outlawed in the EU — Proton is moving most of its physical infrastructure out of Switzerland. Lumo will be the first product to move.
This shift represents an investment of over €100 million into the EU proper. While we do not give up the fight for privacy in Switzerland (and will continue to fight proposals that we believe will be extremely damaging to the Swiss economy), Proton is also embracing Europe and helping to develop a sovereign EuroStack(new window) for the future of our home continent. Lumo is European, and proudly so, and here to serve everybody who cares about privacy and security worldwide.
They actually don't explain it in the article. The author doesn't seem to understand why there is a claim of e2e chat history, and zero-access for chats. The point of zero access is trust. You need to trust the provider to do it, because it's not cryptographically veritable. Upstream there is no encryption, and zero-access means providing the service (usually, unencrypted), then encrypting and discarding the plaintext.
Of course the model needs to have access to the context in plaintext, exactly like proton has access to emails sent to non-PGP addresses. What they can do is encrypt the chat histories, because these don't need active processing, and encrypt on the fly the communication between the model (which needs plaintext access) and the client. The same is what happens with scribe.
I personally can't stand LLMs, I am waiting eagerly for this bubble to collapse, but this article is essentially a nothing burger.
Porsche is German I believe. Maserati is Italian.
Yeah indeed they are not comparable. I have a huge pickup truck in my building and is on another scale. The problem is also that it's a vicious circle, the more you see cars this big on the road, the more you don't want to be the only one with what looks like a go-kart in comparison.
Sorry, but your spelling was too funny and I have to nitpick. Porsche and Maserati*
I said funny because you might want to look up what "porche" means in colloquial Italian.
Indeed these are generally super/sports car, and you see very few of them in Europe, except for exceptionally rich places. Even in Europe though you see many SUV in cities and I started seeing more and more huge tanks (like pickup-trucks), which I think are more common in US right now.
If I were in the security team of that company, I would never accept ACLs on the bucket as a sufficient compensating control for this risk. Here the ~~best~~ most reasonable would be encryption, which would make the bucket being public relatively unimportant.
When you are collecting so sensitive data (potentially including personal data of people not using your service), you simply can't even imagine doing that by storing the data unencrypted.
Edit: grammar
Because it's unnecessary in almost all cases. So far there is only one community which forbids people to comment based on who they are, but otherwise the rules boil down to standard acceptable behavior according to common sense. It's also a nuisance for users: I am quite sure nobody wants to click several times and be derailed to check rules (on mobile) for every comment they want to write in every post they see on a feed. If this would be expected as standard behavior, I would guess even less interactions will happen.
Based on the comments here and in the previous similar post I have seen, the vast, vast majority of people (presumably men) highlight how this is a problem of visibility of posts in public feeds.
It's a tradeoff between having the community public for discoverability and accepting that many people will not check the rules and violate them, some inadvertently.
The alternative is to make the community private, and accept that women will need to discover a women-relates community by searching for "women", which doesn't seem incredibly unlikely.
From the sentiments I read, most people wouldn't care at all if the community was private and wouldn't have a desire to "invade" it. I definitely feel part of this group.
Considering that it's in the interest of the community (apparently) to have only women, I think it's fair to expect the (minimal) effort from future members to look for it (plus advertising it in posts etc.) on them instead of expecting the vast majority of the users (the fediverse is mostly males) to add friction and having to check the rules of every single community of every post they open (now it might be a community, more might come). Yes, community rules are important, but being realistic, if you don't behave like an asshole you don't need to worry about them in 99% of the times.
However, if this tradeoff is not deemed acceptable, I think there is no point complaining about people "invading" women spaces because it's guaranteed that many people will comment without reading the rules, as I am sure the almost totality of users does all the time. Even without counting the ones who intentionally violate the rule, there is always going to be an organic amount of people who will do so inadvertently.
At this point I think the tradeoff is so clear, that discussing the topic in such a confrontational way looks more like rage-bait than anything aimed at solving the problem.
Really annoying interaction. I am out. Cya.
That's not the argument, and you know it, which you need to understand, now it makes it even harder not to think maliciously about the good faith you bring to the conversation.
In case you actually care about it: I feel your statement not only unfairly characterizes white men (not all of them, taking blame for other demographics too etc., etc.,) which who cares, but also is completely exclusionary of all those women who were are not historically oppressed by white men, for example those in different parts of the world, those themselves part of racial minorities etc., and that's what I think is racist. Of course, in that US-centric perspective the world is the same as for Hollywood disaster movies...
You disagree for sure, but since you were interested in comedy...
Only drive is. Email is not always e2ee, it uses zero-access encryption which I believe is the same exact mechanism used by this chatbot, so the comparison is quite fair tbh.