The Free Software Foundation, in its texts, often uses the phrase "the free world" to mean the realm of computing without proprietary restrictions, surveillance, etc.

Approximately since Snowden, I've become more and more convinced about both the fragility and the value of this free world.

And today, I basically see the tech giants as colossal enemies.

Career-wise, henceforth I will avoid proprietary systems and dedicate myself to working on privacy-enabling free software, even if I make less money.

Many people in the free software movement have had more foresight and ethical intelligence than me, and I salute them! It's only recently that I'm able to start formulating my techno-political views in a coherent and strong way.

Now, looking at a device like this, I automatically compare it to something like a tractor or plow. It demands constant connectivity to Google HQ... it's full of secret code... it requires, for its basic paradigm, a private company's acquisition of staggering amounts of surveillance... and so on.

When I think about what to work on, a guiding question for me now is "What would Google not do?"

I look forward to contributing to the free world!

(Sorry for this quasi-manifestoish tone...)

> (Sorry for this quasi-manifestoish tone...)

Don't be. I think it was very well said, and while I've been a bit of a Free Software hippie for a while it keeps hitting me over and over just how far ahead they saw.

It's amazing to me that free software is still strong after all of these years. I can remember back in the early 90s being fed propaganda from my college professors about "the communist" Stallman and his friends. They had made plenty of enemies back then and countless more since. Yet, they kept to their principles and moved things forward to the benefit of billions of people.

They made enemies, because oh so many wanted to bootstrap from academia into business by putting proprietary wrappers around freely shared code.

But the GPL basically forbids that.

Nevermind the fact that most researchers hardly ever publish their source code, and often when they do it won't build on anyone else's machines.

But do you think that free software can keep up against these giants? In the near future, it will all be about having large amounts of data, and processing power; it will be less and less about the actual algorithms.

I'm afraid the only way out will be to rethink the economy.

I think a neat solution is home-serving. A little box with big storage which acts as a hub for your family's digital life. It relays all your devices, gathers all info they're spitting out, and works on it. Results are fed back to the UIs.

When you're out and about, your devices tunnel home automatically, knowing the endpoint is trustworthy (which is more than can be said about traditional VPNs). All your photos, tweets, posts, and all other brain farts straying into the open world are never sent out directly by the device they were produced on, but by the server at home instead.

Tor could finally work as intended, with millions of boxes in the network, all handling each other's traffic. Add new projects like IPFS, and the whole centralised cloud bullshit starts to crumble. Not just from a privacy pov, but features. Your home box talking to the neighbours' home boxes by itself is a whole lot more powerful than all parties meeting on some obscure server somewhere, although I find myself quickly coming back to privacy when thinking about advantages. I do hope there is room for other big features, otherwise getting this box into peoples' hands will prove difficult.

I see it as a kind of decentralised centralisation: your whole digital life is based on this one machine, but it's in your home, you own it, and you can do with it whatever the heck you want. No ads (!), no monetization of your private data, which stays in your hands at all times, except of course once you share. Still, then it will be in the hands of those you shared it with, and hopefully not huge corporations with little incentive to do no evil (who the hell thought this was an appropriate company motto?).

Most everything for which we turn to Google and Facebook can be done much more privately at home (office things, communication, sharing shit...), except maybe search. I have little problem in keeping Google as a search machine (they do a great job) once they stop waiting for me at every. single. corner, and following me around the bits inbetween. Decentralised search is hard, but I'm fairly optimistic once a basis is laid out, someone smart takes on the challenge (and is able to solve it, too!).

Regarding your last sentence, rethinking our economy isn't a bad idea in any case. Capitalism is fundamentally unfit to be a fair system, and if a socially fair system is what we want, we have to get rid of some ideas (like this infinite growth nonsense, or that education is obsolete. Education, in whatever shape or form, is the only way I know of how humanity is not going to spiral to its (intellectual) death).

Search is cool, but Google-style universal search might be a bit overrated.

Google still relies on institutions to provide data in indexable form, and those institutions build their reputations in ways that only partially rely on Google traffic.

I mean, a competent librarian has a kind of expertise that Google's algorithms don't, so that's one situation to explore for a post-Google idea of finding information (of course it's also pre-Google).

The social aspect of information discovery is something that Google and Facebook are kind of fighting over, but fundamentally it doesn't belong to them—it belongs to "us" intrinsically.

They shut down Google Reader but they can't shut down the human tendency to share information!

And the panopticon information provided by Google is often just a mesmerizing massive overload with no curation, weight, intelligence...

Wikipedia is the top hit for so many searches that one could see Google as an interface for it. Add Wikivoyage/Wikitravel, some other community wikis, API interfaces a la DuckDuckGo, social curation, etc, and you might find that the value of Google Search is actually not that incredible.

Yes, google certainly isn't the best we can do in terms of finding stuff, but I think the sheer amount of data they're gathering enables the algorithms to appear more intelligent than they really are by processing more instead of better (as you say, there is little to no curation going on).

This is one of the main reasons I think home serving is a great idea. It enables people with some interest in one another to connect directly, one-to-one, instead of running around in some third party's server. This opens possibilities for exchange and networking on a very personal basis that we don't have today mostly because of privacy concerns (virtual neighbourhoods and the like).

>Tor could finally work as intended, with millions of boxes in the network, all handling each other's traffic.

Ultimately you'll never escape the fundamental flaw of Tor, which is that I, as a moderate bandwidth user, don't want to subsidize some leech's desire to download weird fetish porn in 4K with my connection.

I live in Canada where the scumbag broadband companies all collude to keep prices exorbitantly high, and I pay a lot of money for what would be considered bottom-tier garbage service in e.g. South Korea.

I don't run Tor because ultimately I want to use the bandwidth I pay for.

That doesn't sound like a fundamental flaw of Tor. That sounds like a fundamental flaw of broadband companies in Canada.

>Decentralised search is hard, but I'm fairly optimistic once a basis is laid out, someone smart takes on the challenge (and is able to solve it, too!).

Check out http://yacy.net, you may be surprised!

> In the near future, it will all be about having large amounts of data, and processing power;

I don't think we are even close to the limits if what we can reach with standard desktop and server software.

I agree. The current trend of outsourcing everything to "the cloud" is partially fashion, partially laziness, and mostly dictated by business models - why do something the right way (from engineering point of view), when you can lock your users up in your own garden and extract rent (either directly, or by spamming them with ads and selling their data)?

Our devices have incredible amount of computing power now - a great untapped potential that we could use for something else than for supporting unnecessary indirection layers.

The problem is that our devices are locked up behind NAT routers and IPv6 is starting to resemble fusion power in terms of its ETA.

The future of all of our devices having extremely fast connections existing in a world of amazing, free, peer-to-peer applications still seems so far away.

Sadly so. Few years ago I thought we'd all be on IPv6 by now.

BTW just today I was thinking about IPv6 VPNs. Seems like a good way to extend one's Intranet of Things to one's mobile devices.

FWIW it seems ipv6 is working (for some definition of working) at my house now :-)

"Business models" are why your devices have such incredible computing power too.

I agree. But business models are not created equal. Personally, I'd like more of those giving useful technology and less of those that are artificially limiting it.

Well - it's their business and not your model :-)

The challenge is how do we make it economically viable for both the producer of the technology and the end user to keep it useful and local, while also making it a good user experience?

The thing about cloud-based services is that they leverage scale well, making many things cheaper than they ever could be locally unless you buy a device and use it for long time AND fixes can be rolled out quickly with no lagging install base to cause problems or bad user experiences.

I really do want to have my privacy and keep my data safe but I also recognize that's hard to do without higher cost or more hassle (or both).

- Security

- Reasonable cost

- Availability

- Ease of use, especially setup

- Eye candy

- Social connections

If you can check all of those for an FOSS solution, then I think you are home. Unfortunately most of the points are still not available for average Joe users with FOSS.

Add to that, most people will give you a blank look when you start discussing how companies own your data, and even those who understand just shrug and go the route of least resistance.

It's also worth building networks of free systems even if they aren't immediately friendly for Mr Average Joe, simply to create and maintain a foundation for the future. I believe this is part of the strategy of the Free Software Foundation, which recognizes explicitly that free software often will lack some attractive qualities of proprietary software.

This is more or less what I actually mean:

We have a long way to go with all of the above points before we need megaclouds with asic and huge data *to move the state of art forward.

All of the above be solved without creating a new unicorn startup.

While I agree with your assessment, there is an engineering advantage to the cloud: you don't have to deal with as many different system configurations, some of which result in a broken application and an angry customer. The functional package manager approach (like Guix) seems to solve this problem.

It's an interesting question. Of course there are advantages to having these huge proprietary data volume, so I'm thinking along the lines of, how can we make useful software with the benefits we want, without relying on this kind of proprietary collection? Maybe there are alternate paths that even have their own technical or social or aesthetic benefits? Well, it's a question for the next decades, I think...

> In the near future, it will all be about having large amounts of data, and processing power;

Deep Learning doesn't actually require "Big Data". They went from thousands of examples to millions or billions, but we can scrape that kind of data with open source tools, record with cheap cameras, sensors, etc.

Also, there is a lot of research into scaling big models to small hardware. We can run pretty decent AI on cell phones and small systems.

Third, the AI academic research community is pretty open and posts everything, often including code and datasets. This enables rapid progress, but essentially, it brings knowledge in the public domain. We need that to continue in order to have access to the best algorithms.

It will be much easier than you think to have open source implementations of the best AI tools.

Its a valid point but the world can adapt. One off-the-cuff example, perhaps FOIA will move to a real-time request enviroment where I can offer permission to use my data to small company A and large companies A, B & C have to give direct access to their database about me via API so the information gap is leveled. If Small company A can get enough sign-ups they have access to large amounts of information.

Yes. If one guy can build a self driving car in his garage, I'm certain free software can keep up. (http://www.bloomberg.com/features/2015-george-hotz-self-driv...)

Large amounts of data can also be open sourced, and aggregated. What's large today will be average tomorrow.

>But do you think that free software can keep up against these giants?

On an algorithmic front, definitely. The key areas where free software is kneecapped against large corporate interests are in marketing, which free software has never been good at, and in training set gathering.

In the case of the latter, google, facebook and microsoft have a major advantage in gathering data to do things like improve accent recognition, because they don't give a shit about collecting everything you say via services like cortana to improve their voice recognition, as long as it's legal. That technique applies to a whole suite of other problems as well, unfortunately.

Don't forget UI and UX, in general. The free software pipeline has traditionally been wacky in this front, and is something that matters a lot to users.

I think the whole UX thing is overrated. People will like what they are accustomed to, and dislike what they are not accustomed to. Just look at all the flak Facebook gets when they move things around.

Or look at medical secretaries and their opinions about the new "user friendly" interfaces that replaced the keyboard driven programs of previous generations.

Similar for store clerks.

Supposedly there are doctors in Norway still holding on to their DOS based patient journal software. Arguably because they can operate it without taking the focus way from the conversation with the patient.

Right but there's a level of lock-in and lack of change in enterprise environments that doesn't exist in consumer tech.

Another way out is to divorce free "as in beer" from free "as in freedom" and start charging for freedom-enhancing software. Find an economic model that works.

Why not call it "liberating software". Sounds more positive and is more accurate!!

AFAIK it's fairly difficult to combine many machine learning models (although boosting is a thing). I'm a noob though.

We could do live online or batch training of models in a distributed manner if it is feasible. It would take more time to build new models because we would have to produce more data, but it's an idea.

For my personal use, free software has always been high enough quality; its at least 90% of the way there if not better. And I can trust it.

Maybe we need an open data initiative.

And MyData! http://mydata2016.org/

Freedom has always been fragile and eagerly bartered away for perceptions of safety and prosperity.

> And today, I basically see the tech giants as colossal enemies.

I think it's important to note that in-house voice recognition is simply the Nth iteration of a general trend away from privacy that has been going on for many many years.

Eg: Our emails are scraped, and use to target ads. I see ads for specific things that I've only mentioned as a 'reminder email' from myself, to myself. SMS can be read as well, at least on Android if the user allows it. And even if you are very careful to avoid this (using iMessage, hosting your own email, etc), the people you interact with may be sharing this info. People upload their contacts to random services, and if you avoid doing that yourself, your friends may not. These are just trivial examples in the wild now which don't include state-level surveillance (legally mandated ISP web history tracking, license plate tracking, etc).

I'm happy that having a microphone always listening in your home is bringing so many people around to this idea that maybe having companies know so much about you isn't an OK thing. But another part of me feels that short of strong privacy laws, the privacy ship sailed a long time ago.

Laws are usually written as a reaction to excess. But excess is measured as a distance between two points, and both are able to move: actions can be more extreme, and our judgements can be more or less harsh.

I think things could change quite dramatically if there was a moral panic around it. A few more scandals - something personal that the voting public can really relate to, rather than something vague and distant and somewhat comforting to some people, like mass surveillance.

The private data should not be centralized in realms of Google, Apple, Microsoft, instead it should be federated. This is why in 2014 I issued the Private Internet of Things Manifesto (https://github.com/niutech/priot).

That's why I think an open source distributed & end to end encrypted social platform to replace facebook and google plus is needed too.

I think we need to go even further - we need to reduce the cloud back to being dumb piece of infrastructure, compute for hire, paid by the hour. The only thing it should do is abstract away computation - not centralize data and processing under control of some companies (big or small, startups are actually the most annoying entities in the cloud ecosystem, IMO).

So for instance, I want my calendar or e-mail to be stored somewhere, I don't care where - hence in the cloud. But I want the data to be under my control. I can pay for a reasonable guarantee that the data will not suddenly disappear. I can pay for someone else's piece of code to be run against my data, but otherwise I want that someone else to stay away. Companies can earn money by providing useful pieces of code, and even managing stuff for people who absolutely don't care about how this stuff works - but we do need to reverse the idea. It should be arbitrary code run on demand against our data, not our data feeding someone's machine.

Classic web hosting still seems to do this job. In many cases, your data isn't insanely secure, unless you do the work to ensure it is yourself. But it's unlikely to be mined on a large, automated scale.

The issue isn't creating such a platform, it has been done. The issue is getting others to use it. That has not been done.

We've all been using one since the 80s: email. The interface is just poorly designed for social networking.

The email we've all been using is not all open-source and end-to-end encrypted, though there are open-source clients, some of which support end-to-end encryption.

em... the only thing that is valid to support end-to-end encryption is the end client. Otherwise it's not end-to-end.

Yes, and the end clients many people have been using don't support end-to-end encryption. So, we haven't all been using a e2e encrypted system already. We've been using a system over which e2e can be layered, and very few have been layering that over it. And many using it in a way where even with an e2e protocol, it wouldn't be secure, since they are using an third-party, remotely provided client that can be changed without their notice (webmail).

Well um, if you have an open protocol then instead of a monoculture you have many different clients, and you can't expectto CONTROL all of them and what they do. That's the whole point you are making in the first place. The irony is if you have true freedom and openness on all levels then you also can't control the tools that don't maximize their users' freedom/security/whatever so users of those tools are still locked in.

But YOU can choose to use what you want. And IT can choose to require certain things of those it communicates with. And now you're right back to less freedom in the name of more freedom, hehe.

> Now, looking at a device like this, I automatically compare it to something like a tractor or plow. It demands constant connectivity to Google HQ... it's full of secret code... it requires, for its basic paradigm, a private company's acquisition of staggering amounts of surveillance... and so on.

As someone who used to write code for snowplows, they're also becoming quite centralized. Location, plow settings, salt per mile/km usage and other values are tracked in real time from the municipal office. Municipalities are increasingly strapped for cash, so performing real-time data analysis on their services can save them quite a bit of money in the long run.

How accurate is the voice recognition? Even when restricted to a few command phrases, I struggle to see how this can be overly accurate when running on a Raspberry Pi. I've played with voice recognition in the past, and anything less than 98% accuracy is super frustrating after a week of usage. Siri is the most accurate voice recognition software I've used so far, and even Siri regularly fails to understand some words.

It depends on the tts plugin you use. We have build and tested several tts plugins. I can recommend Microsoft Bing Voice and the new Google Speech API. Both are very rarely wrong.

Aren't both of those "send the speech to the server" systems?

i'd love to see some work done in oss router firmware like tomato / dd-wrt to enable simple home automation tasks. not everyone needs a cloud assistant or has the chops to hack a web server onto their router.

Okay please see http://qbix.com/platform and - if you are interested - email me (my email is greg @ that domain)

This entire keynote just keeps highlighting that one sentence from the end of Maciej's wonderful http://idlewords.com/talks/internet_with_a_human_face.htm

"Yesterday ... I realized how long it had been since I looked at a new technology with wonder, instead of an automatic feeling of dread."

EDIT: Speaking of Maciej, if you're not already following him on Twitter, today is the day to do that. He's having a field day with this keynote.

Google Home: Stasi in an Glade air freshener form factor

https://mobile.twitter.com/Pinboard

https://mobile.twitter.com/Pinboard/status/73298537020423372...

And if you prefer your tweets detwitterpated:

https://plus.google.com/104092656004159577193/posts/MtHn4A9W...

I'm amazed that people still feel this level of paranoia about stuff, when they have a clear option: do not use the product. Concerned about the privacy implication of Google Home? Don't get one. Don't like the fact that Apple Watch reads biometric data? Get a Casio watch. Don't like the fact that Facebook knows who your friends are? Go out more.

The very fact that someone is watching the keynote and going "oh my Gawd, the level of intrusion" at every turn, kind of tells me they are interested in having the features but don't want to provide the data. Otherwise you wouldn't even be watching the keynote. Am I missing something?

(Full disclaimer: I do work for an Alphabet company, so take my words with as many grains of salt as you want.)

>I'm amazed that people still feel this level of paranoia about stuff, when they have a clear option: do not use the product.

Maybe because people are not islands, and don't think like isolated solipsists but also worry about the wider social implications of a technology?

Them not using a troublesome product won't solve that -- and it might not even solve the implications for them (e.g. like your friends can still tag you on photos on Facebook, even if you don't have an account there). Or you know, visiting a friend's house who has the device.

>The very fact that someone is watching the keynote and going "oh my Gawd, the level of intrusion" at every turn, kind of tells me they are interested in having the features but don't want to provide the data. Otherwise you wouldn't even be watching the keynote. Am I missing something?

Yes. 30+ years of data abuses and privacy encroachment by advertisers.

It's not a paid service with siloed data used only for the service's purpose -- rather the service is the lure to gather even more data for targeted marketing/ads.

> I'm amazed that people still feel this level of paranoia about stuff, when they have a clear option: do not use the product

People say that about stuff like Googlemail and Facebook. "Don't use it", except that doesn't always help when friends use it, and feed it with info about you as well. But hey, your fault for liking people who use Facebook or something. Now you can simply choose to not be friends with people who put this "home product" in their home, right? Or you can wear a disguise and talk with a false voice when visiting them, or ask them to turn it off whenever you're over. It's all voluntary, so no biggie.

At what point will all these small things combine into one big "You don't have to read or write anything, or communicate with any other person, or buy anything, or ever leave your house"? That's not even a slippery slope in my mind, more like taking 15 points which are in a straight line and extrapolating the line further. So when you talk of "this level of paranoia", I'd say the flipside of that is considering your stance a certain "level of apathy and/or short-sightedness".

Google Home crosses yet another line. It installs an always on far field microphone connected to Google in a house near me. Not getting one is no longer sufficient to keep my spoken words outside of Google's reach.

This is the same as "if you don't want to be tracked by Google online, don't use Google Search", which conveniently omits that Google is working hard to add a tracking beacon on every page on the internet, via AdSense and +1 button.

StreetView, being tagged in photos by friends even if I don't use Google Photos. I also have a number of reasons to believe Google is homing in most people location information from Android phones without their informed and explicit consent.

Google's privacy practices are very questionable. Google could do better than hide under "don't use Google". What ever happened to "Don't be evil?".

Maybe I'm parsing your tone wrong, but what is so outlandish/surprising about people liking features but not the implications of them? (or often, of the way they are implemented, see every cloud vs local software discussion ever)

E.g. cheald's comment above is pretty clear "I always wanted that, but I fear its implementation"

I think you parsed it correctly. My surprise is more about people watching a keynote fully knowing that most of the stuff announced will be ran by Google, and still being outraged about "the privacy implications." I'm not sure what they expected. A fully open source implementation with pre packaged Docker images so you can deploy your own cluster and petabytes of training data?

The truth about a lot of these services is they only work at the scale Google (or Amazon, or Facebook, etc.) run them. You'd spend thousands, if not millions, of dollars to get equivalent functionality, even if you got the software for free. I've basically had this argument every time someone helpfully suggests "Dropcam/Nestcam cameras should have an option to save data locally." You can have cheap, 100% private and efficient. Choose two.

> most of the stuff announced will be ran by Google, and still being outraged about "the privacy implications." I'm not sure what they expected.

In other words: "It's Google, why are they outraged that we're encroaching further on their privacy? What did they expect?"

At least you guys are honest about being evil, now.

No, you are buying a product whose description is literally "you ask it something, and our cloud service (which costs tons of money and was built over almost two decades) will give you the answer." How do you expect to do that without a roundtrip of a certain amount of information to Google's servers?

How is that "being evil"? Isn't that the product's whole raison d'être? Everything else ("it's going to be recording everything you say and reporting it to the NSA!") is just tinfoil-hat-level speculation and not based on any factual information. If I started saying "In-n-Out could change their burger recipe to include cyanide at any minute and kill all their customers" would you accuse In-n-Out of plotting to kill everyone?

For the record, this is my very own (pretty frustrated) point of view, and obviously doesn't represent Alphabet's view in any capacity.

You are indeed missing something important. We can choose not to use a particular product. But we cannot choose not to use all the products everyone else is using, because that would make us lonely, antisocial hermits without the slightest chance of ever finding work, friends or lovers.

So even if Googlers may find it "amazing" that privacy advocates don't just shut up and go live behind a rock, that's what you're going to have to live with in a free society.

> We can choose not to use a particular product. But we cannot choose not to use all the products everyone else is using, because that would make us lonely, antisocial hermits without the slightest chance of ever finding work, friends or lovers.

I don't use Facebook, Twitter, WhatsApp, etc. etc. etc., you name it. Yet, somehow I am employed, have friends and hobbies, and am happily married. How could that have possibly happened?

I don't use Facebook and WhatsApp either, and Twitter doesn't have my real name, so I know that it is possible to avoid many intrusive services, but it depends on what communities you are part of and what sort of people you want to stay in touch with.

I guess the proof is all in the etc etc etc.

How about things like using Google search, exchanging unencrypted email with people who use ad funded mail services like gmail, using software or hardware that isn't completely open source (or working with people who do), using ad funded web sites, operating systems or apps that track you, using credit cards and other authenticated payment services, using location based services, using the internet without Tor, making unencrypted phone calls?

But yes, strictly speaking you are right. It is not impossible to avoid all of that and still have a social life. It's just very very difficult, and that's why it makes sense to speak up when useful services are designed in ways that create unnecessary privacy issues.

You happened to be born before those tools were invented. Question at hand is how life will be for those growing up now.

I guess you have a point. I, too, grew up before all these things were "the standard" (heck, I didn't have internet at home until I was 22 for crying out loud) so even though it is annoying when they aren't there, I can totally picture a life without them.

Not "googlers", this particular "googler" (me.) Google is a huge company, and I imagine a lot of people actually hold views closer to yours.

I'm just an old codger that can't understand why people have expectations of A, B and C, when they are buying a product that says it does A, promises to do B as well as possible and tells you that it definitely can't do C because it's technically impossible. Like, back in my day people read EULAs and stuff :)

Except soon one's environment will be enveloped by a cloud of such devices, each monitoring, tracking, and associating without consent.

And, please don't think this is hyperbole. Independently, over the past year, I've caught parts of this same vision from two separate (large) companies. This is the low hanging fruit. The rewards are too high, the costs are low, and there are very few downside (to the companies).

This has always been the case across centuries. Information is power and grabbing or keeping it is a generational challenge.

So, you can't just put your arms down and say it is hopeless.

The Free Software Foundation fight was also hopeless when they started, look at what happened since that time and behold how software with available code dominates the market for third-party components.

It is in our hands the responsibility to act and make the new technology to respect privacy and people as much as possible.

Victim blaming is always an option.

I remember having a similar feeling of wonder watching the amazing movie "Her."

I then went down a thought path of what level of personal data the AI would have had in the movie, and started thinking about what that would look like from a monetization/privacy standpoint given todays realities of advertising, NSA surveillance, etc. Pretty scary.

In fact, I'd love for someone to do a cut of clips from that movie with overlays detailing all the bits of personal data that would have been fed to a company's servers based on what is happening in the scene--there are some particularly juicy scenes for that if I recall correctly.

Well, sure, @Pinboard is great if you like snark and don't care about accuracy.

For example: "What’s been missing from my video calls is the ability for people to see me before I’m ready" [1]

This is when you are calling them. Why wouldn't you be ready? It's more like seeing who is outside your door before opening it.

[1] https://twitter.com/Pinboard/status/732992053668253696

I have no idea, but I saw this tweet

> @Pinboard they did talk about privacy though: the video app shows your camera feed to whoever calls you before your call starts

https://twitter.com/computerality/status/732995563034169345

To anyone reading, just to be clear, that's not the case at all. It shows the caller's video, and they're completely aware of the fact.

> EDIT: Speaking of Maciej, if you're not already following him on Twitter, today is the day to do that. He's having a field day with this keynote.

Is he? Last tweet I can find of his is from yesterday. Could you provide the link you're using?

@Pinboard on Twitter, not his personal account.

Thanks!

He is a phenomenal writer. Just realized I've been reading him for well over a decade now.

Ah, you knew the dog before it came to school.

I had to look that up, but I think I deserved it.

Class! ;-)

Link?

@pinboard

You probably have on in your pocket already, is the thing.

(I agree though, I don't want this in my house, and I turned off the "Ok Google" functionality on my phone)

I do. And I recognize the hypocrisy of that. I think the difference for me is that my phone isn't a permanent fixture in my house - it's not explicitly a surveillance device. Echo/Home are explicitly audio surveillance devices, though ostensibly benevolent in their design. I can stick my phone in a Faraday bag easily enough if I want to.

I guess what it comes down to is that while I recognize that I sacrifice a measure of potential for privacy with my phone, I judge the benefits to be worth it. I can't say the same for Echo/Home, and it somehow feels qualitatively different in that phones aren't designed to be always-on microphones constantly processing audio to send it off to a server somewhere else for analysis.

To be honest, I trust that Google and Amazon are probably acting in my best interests with these products, for the most part. I don't think it's all an evil conspiracy to get microphones and cameras into my inner sanctum or anything. I believe it's very possible for a product like this to be mutually beneficial for provider and consumer. And hey, if a state actor wants to surveil me, it's going to happen regardless of these devices being in my house. But as we've learned just how fragile security is, it seems foolish to me to rush off to install black-box monitoring devices all over and just hope that they do what we think they are doing. I love the idea of these things, but they are such potentially powerful windows into our lives that I think that we have to be really sure the value they provide is worth the security risk they entail.

Its not that I don't think that Google and Amazon are probably acting in my best interests now. They probably are. Also not that I think that the government couldn't spy on me if they wanted to. They could.

The scenario that worries me is that years from now, Google and Amazon may be coerced into turning over what I said yesterday to a corrupt government fishing through the past for word-crime. And boy-howdy, it turns out they recorded everything and retained it forever. Surprise!

>The scenario that worries me is that years from now, Google and Amazon may be coerced into turning over what I said yesterday

Amazon has said that they're only recording what happens after the hotword is triggered. That's why they can't do custom hotwords - listening for "hey alexa" is built right into the hardware and it doesn't do anything until it hears that. Unless they're flat-out lying, they can't provide any information about what you said yesterday to anybody because they don't have that data.

My 2012 Moto X has a trained keyword (and in fact a dedicated low-power specialized processor to listen for it - one of the things I like about that phone). No "OK Google" for me; it's "Listen please", in Russian. Never tripped by mistake.

If we believe Snowden then Google and Amazon as well as any technology company that collects user data are enabling spying on you for many years now.

> I think the difference for me is that my phone isn't a permanent fixture in my house - it's not explicitly a surveillance device.

For most people, its a permanent fixture on their person: people these days leave their home more than they leave their phone.

> Echo/Home are explicitly audio surveillance devices, though ostensibly benevolent in their design.

Echo/Home are no more explicitly audio surveillance devices than cell phones are.

> I can't say the same for Echo/Home, and it somehow feels qualitatively different in that phones aren't designed to be always-on microphones constantly processing audio to send it off to a server somewhere else for analysis.

Modern phones (considering the hardware and software stack together) are, in fact, designed to do just that, both Siri and Google Now voice recognition works (though it is, IIRC, disabled-by-default in the latter case) from the lock screen. Its just as always-on as Echo/Home.

One key difference is power consumption, and to a lesser extent, data consumption. It is not practical for your mobile phone to continually spy on everything you say, due to battery issues; however, it can listen for a keyword to wake up to, and then do the more high-powered voice recognition. So the scope is limited, or you will just have a dead phone in your pocket (which, of course, will also not be listening to you).

With something like Echo / Home, the always-on power source makes it technologically feasible for it to always be listening to you as well, without needing to wake up to a keyword. Now, they may as a feature only start processing based on a keyword, but you don't have the "comfort" of knowing that it is technological limitation rather than a software decision that may or may not be in your control.

Cell phones aren't allowed into classified environments in US government buildings because they can be remotely turned into listening devices without the owner's knowledge. There's been guidance on this for a long time. The cell phone in your pocket is definitely a surveillance device.

Let's be real. You don't keep your phone in a Faraday bag and you probably never will.

Even if you do, it can still record audio, and transmit it when you take it out

Ever tried recording audio through a closed bag, Faraday or otherwise? I doubt it would be of much use...

The carrier needs to remotely tell the device to enter into a special mode, so a faraday bag would be an effectively method to block this.

Unless the device is programmed to automatically enter into that mode in the absence of any signal on the assumption that if it is in a shielded location it is likely interesting.

Until the next time you take it out of the bag to actually use it.

Nope, I dont. And I agree with @cheald. It's a big shift to have a "press to query" as opposed to a vague keyword-based "always available".

I know some technophiles coworkers who have an Echo, and I couldn't for the life of me trust Amazon, Google (or even Apple) with potentially the always-on stream of audio from my house.

I really wish these various voice offerings would offer push-to-talk as an option. It would solve a whole bunch of problems: It would activate reliably when you want and almost never accidentally, you don't need to use awkward code phrases, and it can trigger results as soon as you release the button instead of having to wait for silence. It would also allow for better privacy by making a phone in which the microphone is hardware controlled by the button.

It just seems so obvious to me that I don't know why no one has done it. I guess needing a new button makes it harder to sell, but this seems like a great use case for smartwatches.

I think that's what some folks hope the Apple Watch and/or Android Wear can do - be conduits (like ST:TNG Communicators) to cloud supercomputers.

I've ditched the smartphone. And, for the most part, the phone.

I'm not at all happy with the trade-off any more.

I've got a tablet, both cameras taped over. Killing the mics would be a Good Thing.

Sigh.

Honest people do not go offline, only people with something to hide do. Honest people have all microphones accessible and all cameras untaped. I am afraid you have been flagged by NSA because of your suspicious behavior pattern.

Tablet connected to a network?

Frequently, yes. Though not 3GL/4GL mobile networks.

I'm aware of the risk and hypocrisy. I'm also far from happy with it (I increasingly dislike Android, Samsung, and with varying levels, Google).

But given the balance of something I can power down, that isn't always on me, and the portability and cost benefits over an alternative laptop, its a far-less-than-perfect satisficing solution for now.

I'm thinking my nexus will be my last Android device, not decided yet what I want to replace it with but dumb phone is looking likely, I'm either at home, the office or somewhere I can use my laptop so don't really have the need for a tablet, I might been able to google the odd thing now and again when out and about but that's a once or twice a week thing for me.

I've come to resent carrying a phone all the time, I rarely answer it and resent that "I tried ringing but you didn't answer!" whine you get as though it's beyond incredulous that you would ever not answer the phone.

What I like about the tablet is the size, the battery life, the switching between landscape (generally: composing w/ keyboard) and portrait (generally: reading long-form content) modes. A 10" form factor plus bluetooth keyboard is sufficient for some Real Work (though that's hugely crippled by system and software limitations).

As a comms device, on a sufficiently fast WiFi/broadband connection, it's also useful. I've not done that often, but it's been done, and I was impressed.

The OS is a mess in many particulars.

It handles external storage poorly. It doesn't multi-taske well. Multi-window mode is specific to application. The default shell userland is unforgiveably anemic (Termux, one of a few available add-ons is much better). Lack of comprehensive privacy controls, or insight, is a huge issue.

The app "ecosystem" is pathologically broken. I've written on this at G+, my feeling is it needs to be scrapped.

Samsung's own tweaks are also pretty bad. The fact that the device is entirely locked down from a bootloader perspective (it was a bit of a panic on-the-road buy) has become beyond annoying. Inability to remove certain stock apps is a major concern.

Google's "Play" store is beyond annoying.

I'm watching for news of Firefox OS and Ubuntu's mobile offerings. I'm not particularly hopeful. A small laptop _might_ be a suitable replacement, if I can park Linux on it (without systemd).

Mostly it's a very effective advertisement against itself.

And more generally: the tech world very, very, very badly needs to find a non-advertising business model.

Have you tried Bq Aquaris M10 Ubuntu tablet [0]?

I've got one and although it is not ready for the general public yet, it's a little gem for us free software fans.

[0] http://www.bq.com/uk/aquaris-m10-ubuntu-edition

No, I haven't, though that looks interesting. Quick thoughts:

16 GB storage is far, far, far too little. That should be upgradeable. The problem with microSD expansion is vfat. That's crippled on both capacity and permissions. I'd also prefer encryptable removeable media.

Speakers. I want my devices to NOT have them. I'll attach via Bluetooth or a wired headset/mic combo. I'd also prefer cameras be shuttered. That's both for protection (lenses get scratched) and privacy.

Other than that, yes, it's headed the way I'd like things to go.

Erm, meant mics not speakers.

Input devices should be clearly and unambiguously disableable, or external.

The external storage thing is an accident of history, with perhaps some MAFIAA meddling.

When the first Android device shipped, all internal storage was dedicated to OS and apps. But OEMs wanted to advertise that they had X gigs onboard. And thus they started partitioning internal storage, and mounting one part as if it was removable memory.

Problem is that apps could not go on removable memory, so people bought a device only to find that a few apps was enough to max out that side of the partition.

And thus Google came up with "move to SD".

But then that got into trouble with USB data transfers, as the "SD" had to be unmounted on the Android side before it could be mounted by the PC over the cable.

So somewhere around 3.x Google adopted MTP, and union mounts to emulate a FAT partitioned SD (for legacy reasons).

But at the same time they introduced new access permissions, but reserved write permission to actual removable storage for system level apps. Thus you could use your PC to transfer music and such onto a SD, but you could not officially do so from within Android. Various OEMs, Samsung for example, modified the permissions file so that their devices retained the old behavior.

Since then Google has in fits and starts modified the MTP support so that it can also be used by internal apps to write to removable storage without having to deal with permissions. At the same time they have tried to lock down access to the "SD" even further as various dumb app devs have used it to store sensitive user data for any other app to see.

Thing is that going via the MTP subsystem invites DRM, as the apps talk to a database that then talk to the FS. And that database can be incomplete, or the subsystem can outright lie to the apps. And it so happens that Google adopted MTP along the same time as they introduced Play Music and Play Movies.

Then again, the consumer UI/UX designers have long been tilting the windmills over the whole files and folders thing. For some reason they see it as a failure of UX, and thus something that needs to be at least hidden from the user, if not outright abolished. See numerous attempts at replacing files and folders with a grand database of metadata, that will "magically" pull out everything you have stored related to that company project or aunt Tillie as needed.

I don't know about Android (though I assume it works the same way), but iPhone's "Hey Siri" is done entirely on-device, so until you activate Siri, nothing you say is sent to a server.

People keep bringing this up and it's silly. It can just record what you say and send it later.

It makes literally no sense for the Hey Siri functionality to do that. This is just a very slightly altered version of "it's an internet-enabled device with a microphone, it could be hacked and told to turn on its microphone remotely", which is a legitimate, if fairly paranoid, complaint that applies to all such devices, even fully open-source and open-hardware ones.

Though is that auditable? Siri's not Free Software AFAIK.

You can at least audit the network traffic. And since people have been able to hook their own software into Siri, you probably somehow can break open its encryption and look at the content. (Unless I misremember how that worked)

Which is why I keep mine in a lead box at home.

an interesting side effect is that, until you open the box, the phone is in a superposition of both ringing and not ringing at the same time.

I probably don't -- my phone is often in another room when home.

Ditto.

Until I can set the endpoint this thing talks to[1], It ain't living on my LAN.[2]

[1] This, of course, implies an open source server I can host as well.

[2] Maybe it is just me, but I choose to leave my phone at home fairly often. It is a bit of a luxury for me, and I find I enjoy the feeling when I'm not contactable. Things like this are closer to furniture, and don't take an affirmative "opt-in" (like taking your phone with you) to be functional in their role. So when my brother's kids come over, I'm opting them in. When a visitor is wondering around half-awake looking for the coffee, I'm opting them in.

I realize some others seem to feel that this is identical to cell phone surveillance (but if so, and if you always have your phone, why bother with this?). I don't, and I'm not alone. The law recognizes major distinctions between 'home' and 'not-home'; I mention this only as a demonstration that the distinction is a clearly rooted one for a lot of people.

Never EVER under any circumstances would I put a closed-source cloud-connected always-on microphone in my house.

Google's entire business model and value as a company revolves around their ability to maximize the accuracy of their consumer profiles. They have no incentive to do anything other than maximally invade privacy. A device like this from them is even creepier than the Amazon Echo. While it's not released yet, I don't see a disable microphone switch on it either. At least the Echo has that-- though I imagine most users would forget to use it.

The defenders will say "but it only listens when it hears the keyword!" What assurance do I have of this? How secure is this device? Is the keyword recognition performed locally or remotely? What is the definition of "listen?" I'm guessing that like glass the privacy policy will allow them to collect everything.

To the advantage of society, Google's value also lies in not alienating people to the point that they shun its products and services.

Google cannot sell advertising based on my eyeballs if I won't use Google Search, block ads, avoid Google Maps, and download video via yt-download vs. watching it on the far-less-convenient YouTube website or application.

Google have lost me to search, and several other products, for precisely this reason. I don't know the segment of the population I represent, but it is a segment.

A US Department of Commerce survey release this past week reveals that 20% of the population consciously avoids online activities already due to privacy and surveillance concerns. This isn't fully attributable to concerns over Google (and that almost certainly poses a subset of those dissuaded), but it is a surprisingly large effect of privacy concerns.

The trust factor you mention is a huge one. Cognizability is a wonderful word I've run across recently (from William Stanley Jevons' discussion of money). It refers to the ability to instantly and unambiguously recognise a characteristic or trait. Electronic devices lack cognizability of privacy.

Glass didn't do so well as I recall.

I've switched to DuckDuckGo and "paused" various activities within my Google account settings. Still, I can't help wondering if records I've deleted there are simply my copies and they have their own backups stashed somewhere.

Google is known to never delete anything, not even intermediate revisions.

Interesting. Do you have a reference for that? I'd be interested in more information about what search information (amongst other things) they keep.

20% -- I hope it's that high. That's a high enough number to get peoples' attention and challenge the prevailing meme of "nobody cares about privacy or security."

(Privacy IS security. There's not really a distinction.)

Actually higher, see my follow-up above.

20% of the population consciously avoids online activities already due to privacy and surveillance concerns

citation needed.

Actually I got that wrong, the number is 29%. The 20% figure applies to those who are aware of fraudulent credit card activity.

https://www.washingtonpost.com/news/the-switch/wp/2016/05/13...

"Nearly one in two Internet users say privacy and security concerns have now stopped them from doing basic things online — such as posting to social networks, expressing opinions in forums or even buying things from websites, according to a new government survey released Friday.

This chilling effect, pulled out of a survey of 41,000 U.S. households who use the Internet, show the insecurity of the Web is beginning to have consequences that stretch beyond the direct fall-out of an individual losing personal data in breach. The research suggests some consumers are reaching a tipping point where they feel they can no longer trust using the Internet for everyday activities."

More: https://www.ntia.doc.gov/blog/2016/lack-trust-internet-priva...

Those of us with Google smartwatches have had this functionality for some time. Its very convenient to just whispers, "OK Google remind me at 3pm tomorrow about the dog's vet appointment." Or "What's the weather in Reykjavik?" Having this functionality on your phone, tablet, or computer is very different than having it right in front of you at all times. Its hard to quantify, but there's an inconvenience of pulling out a phone or a tablet and even then muscle memory dictates that you'll probably just start typing and swiping instead of speaking.

Having this all tie in with various smarthome appliances will be interesting as well. Sure, I can open my garage door by using an app on my phone but I'd rather just say, "Open the garage door." I think ultimately we prefer to do things like we're dealing with other people, not machines. Amazon's Alexa was a good first step towards this. I'm glad Google is chasing Amazon as Google has become a Microsoftian organization that only does well when they're chasing a competitor or having one right on their heels.

It's funny you say the second paragraph - it feels like it directly contrasts the first (OK Google was first by a good margin).

If I was a shady business, a nefarious government, or a malicious hacker and I wanted to eavesdrop on you, I would probably attack the vector that spends much more time by your side and can easily hide its data connections from you, e.g. your mobile phone. As long as these home automation devices ride on your own personal network, it is easy to monitor to what extent they are sending data back home.

whats the argument here? We shouldn't care about privacy because we have iPhones?

we shouldn't tight the seatbelt wheb driving because we're going to die by cancer in the long run anyway?

My argument is that you should prioritize your worries and these devices are a lesser threats than phones. To use your analogies, I wouldn't worry about tightening my seatbelt or getting cancer if I am in the back of an ambulance on the way to the hospital for some other life threatening issue.

Or perhaps a better analogy, I wouldn't stress about keeping the windows of my home locked if I never locked my front door.

An open alternative seems to be https://mycroft.ai/

(I heard about it a while back, but I didn't back it so I haven't read the latest updates)

That's a step in the right direction, but I won't be adopting any similar tech until it can be self hosted (and preferably live on a non-routable vlan, maybe with proxy access to white-listed websites)

I laughed hysterically at the same fact last week. Everything we dreamed of 20 years ago feels like a burden now.

Hysterically sounds borderline crazy. Step away from Alexa, nice and slow.

Ok a bit strong, but the self fulfilling dystopia really threw me off.

Whenever I see one of these things, and the people who happily purchase it without giving even two seconds of thought to the privacy implications, it makes me realize how important organizations like the FSF and EFF are.

You know, I feel the opposite.

When I was younger, I wanted the same thing. To be kind of like Tony Stark in Iron Man, with all the convenience and power that future technology seems to promise.

But now that I'm old and boring, I'm perfectly happy with my non-futuristic life. We still have an iPhone 3G which we use as an iPod around the house (which we plug into our speakers the old fashioned way, by plugging one end of a headset cord into the iPhone and the other into the speaker's AUX jack), and we have our laptop computer which we use for facebook and reddit.

And that's the most "futuristic" technology I care to have. I don't plan to buy a VR headset. I take notes with a pen and paper when I'm not at my computer. We still write our grocery lists down that way and mark them off in the store with a pen.

It may be boring and un-futuristic, but it gets the job done just fine, and I really don't have any complaints. I'm probably in a tiny minority on HN though.

I have a similar view but for different reasons (though I do own an S7 - but for different reasons[0]).

I still want to be like Tony Stark, or captain Picard. I want the cool future stuff. But I came to two realizations - a) it's always cooler in the movies than in real life, but b) even taking that into account, our future sucks compared to theirs. In the movies I like, technology was about empowering people. They were tools. Today, more and more the products are nice looking but barely functional, and sport the minimum subset of features that can be sold to the lowest common denominator.

So take Google Now. Does it recognize voice? Yes, quite well I'd say. Would it be a problem for Google to let you hook up your own actions and data sources to the system, so that you could make yourself a Star Trek environment with a spare tablet attached to a wall? No, it wouldn't. It's an obvious feature. A feature which they - and pretty much everyone else - refuses to provide. Why? Because fuck useful. Lowest common denominator doesn't need that.

[0] - I'm tired of buying shitty hardware. When I change the phone, I prefer to shell out for a top-of-the-line model to be 100% sure it will work fast and stay ahead of the bloat. I learned it the hard way with my first smartphone, which was barely powerful enough to lift its own OS - and trying to connect it to Internet always ended up with having to pull out the battery. I was stuck with it for a couple of years. A smartphone is something I use quite a lot every day, and even little frustrations accumulate.

I love the dissonance between "I have S7" and "model to be 100% sure it will work fast and stay ahead of the bloat" ;-)

Is there? It does work blazingly fast and does not hang on anything I can throw at it :).

Not so much as you might think, I'm pretty much the same as are most of the programmers I know my age IRL, been programming since I was 7 so nearly 30 years, have no intention of buying VR unless it's useful for work, I'm past the point of buying tech because it's new, I want genuinely useful and less hassle than the alternative.

I'm not comfortable with this either, but I recognize it's hypocritical-- after all, smartphones have microphones AND camera and are internet-connected running proprietary software.

There's nothing hypocritical about not wanting FURTHER intrusion...

Not to mention, smartphones don't record all you say 24/7 and send it to a foreign data center, except if tampered with. These devices do as their normal operation mode.

Not to be blindingly trustworthy or anything, but I'm pretty sure none of these devices currently state that they send everything you say 24/7 (or more specifically, the Echo). That would, again, only be if it had been tampered with.

The way I see it, the difference is the burden in not having the device. For a lot of people a smart-phone isn't necessary, but it's extremely inconvenient to go without. Whereas these devices are new, so they aren't ingrained into our culture yet.

I agree with you and OP. If there was a good open-source version of either of these, I'd buy them in a heartbeat, but there's not.

Kirk wouldn't have gotten away with half the shit he did if every word he said to the computer roundtripped to the Federation and back before being processed.

Fortunately for him, the society of the Federation isn't driven by greed and personal profit seeking anymore, so they can focus on doing things the right way - like making the starship computer process voice recognition instead of sending it God knows where via subspace.

> Now, I just see an internet-connected microphone in a software black box

A little while back, there was a kickstarter for "The Ubi"... basically as you describe.

A non-mobile v0.1 Ziggy [Quantum Leap] where you'd plug it in and ask it generic questions. "Ubi, what's the weather?" and the like. IIRC, the Ubi is slowly but decently chugging along.

However, your questions on security are valid.

I was getting prepared to argue with you, but then I thought about it and realized you were right. I'm not prepared to give Google that much control over my house, especially when it's completely cloud-based.

However, I am totally willing to use cloud-based voice recognition software, because the machine learning clusters required don't fit in my house. Sure, you can run basic voice recognition software on a server or a laptop. But that only gets you maybe 80% accuracy if you're lucky. There is a huge difference between 80% and 98% accuracy, it's the difference between using something every day, and turning it off after a week of frustration. (I've been there myself, I tried building my own voice recognition system for home automation.)

But I think that's really the only packet that needs to leave my home network. I hate that my Philips Hue bulbs need an internet connection to work.

There is an open source alternative to Google Home: Jasper (https://jasperproject.github.io)

You might be interested in mycroft, then: https://mycroft.ai/

Let us be reminded that the FBI can neither confirm nor deny that they've accessed the microphones on the Amazon Echo of suspects, according to FOIA requests.

Adoption of this tech will hurt general privacy. Find me a home where there isn't an internet enabled microphone or camera. Even if you are security conscious, are your family, friends, coworkers and the people you are near?

This looks promising.

https://www.kickstarter.com/projects/aiforeveryone/mycroft-a...

https://mycroft.ai/

Does everything else in your house run open source firmware?

How does source being available tell you whether your device is secure? Are you auditing it, then building and installing the firmware yourself so you know that the binary matches the released source? Are you doing the same with the bootloader?

How far are you willing to take your paranoia?

MyCroft?

https://mycroft.ai/

or Jasper.

> When I was younger, I dreamed of something like this. Voice control for my home!

You're making it sound like it doesn't already exist. This is a me-too product from Google as a response to Amazon's Echo which already does home automation, voice commands etc.

I'm aware. This thread is about Home. I've said similar in threads about Echo. :)