But some might say that because it's not open source you can't trust them.

Personally I trust the money I give them, they promised me privacy, I pay monthly, if I am ever betrayed I'll leave apple ecosystem forever and they will get less money. So they basically have no incentives to lie to me. Yes it's all based on trust but this always come to that at some point.

If forfeiting icloud privacy gives them access to a billion new hardware customers (hello China!) as iphone sales are dwindling, do you really believe they will stick behind icloud privacy ? The point being that they may have more incentive to break their privacy promises than you think.

But still, at the moment apple being a hugely succesful hardware company gives it less incentives than say an advertising network (hello google), a "give us all your data and we'll make it available online for you, also ads" (hello facebook Inc.) as their revenue depends mostly on hardware not on ads or software licencing or investor story time. This may change when profits and sales go down, we have already witnessed other hardware vendors making moves such as lowering item sale price with a strategy to recoup the loss with exploiting/reselling user data later (hello samsung).

And should it not be the case? Theoretically.

As for the reasoning why they do not have incentive to lie to you goes same for anyone and pretty much anything where a wrongdoing takes place that shouldn't have happened in the first place. It could be anything. If we go for examples it will be stretching it just too far.

The middle ground can be - an easy backup/sync/mail service that does the heavy lifting - the transport work and we encrypt decrypt on the client side. For example, we can't have a transportation company if all we have to do is send a few packets every month across the company or globe. But we can have an unbreakable lock/safe/package in which package the stuff and the receiver is the only person how to open the stuff. I have never really been good at analogies but I hope you get the drift.

If only they could write an easy app that uses the service APIs and code for that app is open source and all it does is encryption decryption (generally speaking) on the client machine. Something BackBlaze and CrashPlan claim to do (they are closed source btw) and so does Tarsnap (haven't used it - too complex and pricey for my use case; and not sure if it's open source).

FWIW, Tarsnap is not under an open source license, but you do get the client source code (and you're encouraged to audit it before compiling).

I'm not quite sure what you mean by "free of charge (via up-front subscription fees, of course)" here. Do you mean an extra "free" feature on top of your paid subscription or do you mean a freemium model where everyone gets the feature but the free users are subsidized by the paid users? Or do you mean totally free?

In the first two cases, I'm afraid the answer is that the only economic incentive is people making purchasing decisions based on the feature being present. If there's no increase in demand, there's no economic reason to implement it. Unfortunately, aside from the HN crowd, not many people seem to care much about privacy.

In the last case, I think it's never going to happen. Nothing can live long without money and if your users aren't your customers, they have to be your product in order for you to survive.

> Is there a business model that is able to ignore the advertising and marketing value of your data, yet still provides enough value to fuel the growth that Google, Facebook, and others have experienced?

I think WhatsApp has demonstrated this no? It's been a paid subscription from the start and as far as I know, the data hasn't ever really been used for marketing or advertising. It's fully encrypted now too.

> Asked another way, would these cloud/social services still be able to exist as we know them if their providers were not allowed to collect and exploit this data?

In terms of collection, some services require access to this data. For example Google can't send you a notification telling you about your flight status if it can't read your email to get your flight confirmation. It also can't recommend videos on YouTube or pay creators without access to watch histories. I also doubt that more basic products like Google Search can work as well as they do without knowing which links you're clicking to tell them how good the results are.

In terms of exploitation, I think there's definitely an argument for users paying to, for example, not be advertised to or have their data withheld from marketing exchanges, however there's no demand for it.

No. It's been bought out by facebook Inc. in 2014.

excerpt from whatsapp legal info:

If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences. Existing users who accept our updated Terms and Privacy Policy will have an additional 30 days to make this choice.

But for new users, well tough luck !

Their encryption was criticized when it was shown that it is implemented in a way allowing whatsapp to replace the key transparently without notifying the user.

Bonus excerpt from whatsapp legal info:

As part of the Facebook family of companies, WhatsApp receives information from, and shares information with, this family of companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings. (...) Facebook and the other companies in the Facebook family also may use information from us to improve your experiences within their services such as making product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads.

Where do you get the idea that there is no demand for this ? It's a recurrent demand and it is consistently declined for business model reason by the facebook-like (see investor storytime[1]).

Then there is a compelling argument that paying not to be advertised is only going to make you a more valuable target to be advertised to.[2]

Likely paying for having your data withheld from marketing exchanges will increase the price of your data on the market while not providing you any way to be sure it has effectively been withheld.

The only way is for this data not to be collected in the first place.

[1]: https://www.theatlantic.com/technology/archive/2014/08/adver... [2]: http://zen.lk/2015/07/19/Why-you-will-never-escape-ads-by-pa...

A free, open source, peer to peer infrastructure is the only way out.

Not for profit organizations have self-interest too. We just don't always know what it is.

I think what we should be looking for is alignment of self-interest and where that is not possible we need good balance of power.

I don't see how any of that is aliged with the users' interest. Of course, they will also spend quite a lot on marketing, trying to make you believe the opposite.

Also, in addition to the business model, the whole entity of a for profit corporation is rather transient. And when we're talking about an infrastructure for storing, relaying and accessing information, that's definitely not a good thing. I don't think google, facebook, dropbox or github will be around in a couple of decades, due to political and economical reasons. It's hard enough to keep information around the face of technological advancements (new hardware architectures, protocols, algorithms, data formats, etc), so we really don't need these additional obstacles.

Not sure why GP assumed this must be free of charge; tech-savvy consumers also tend to have money.

If there was a cloud provider with solid infrastructure, full transparency and insight to the network down to server cams, all based on free software, would you have paid extra for it?

Think about MSP models for a moment. Consider how they morphed into SaaS models over time. That "morphing" involved moving the data from an on-prem location to the "cloud". If you look under the hood of infra while this was going on, you see lots of innovation occurring with networking, compute resource allocation, security, storage, etc.

Now think about SaaS moving on-prem. A company has a bunch of their own infrastructure spread across both public cloud and private cloud systems. They want some of that software to have the benefits of SaaS. They want some of that software to be as secure as running it on-prem.

If we can manage to create the right software to enable it, there will be a new business model based on running someone's SaaS software on your own machines. There needs to be a way to deploy this software, and do updates and maintenance of course, but there also needs to be a way to pay for use, updates and that maintenance.

Older models of using license keys isn't very secure and doesn't scale the way SaaS services do. So, you might end up seeing a model like Splunk's, where usage defines license costs. Trouble is, that licensing engine is a pain in the ass to maintain for companies and requires what most to be considered obfuscation to make it secure, guaranteeing payments for use.

If you add cryptocurrencies to the mix, then you have a way to implement a lightweight federation across all types of infrastructure and tie it to the deployment. I won't go too far into the details of that here, but that's what I'm working on currently, and have been working on for a while.