Hey, what's up everybody?
What's up, what's up, what's up?
Hey, hey, hey.
Letting everybody in for Freedom Tech.
Okay, we are live.
Welcome to Freedom Tech Weekend.
My name is Marks.
This is actually the final episode of Season 1 of Freedom Tech Weekend.
Why the end of Season 1?
Well, I just made it up this morning.
Actually, no, I've been thinking about it for like a week or so.
So you might have noticed I did miss a week.
I missed last week.
I was trying to never miss a week, and I did, and I'm sorry.
Even RHR missed, I think, one week in its whole history, so none of us are perfect.
But I'm entering a very busy time of the year for Maple,
and so I just don't know when I'm going to be able to do these on a regular basis.
So for now, I'm just going to take a break.
So this is going to be the end of season one.
We're going to leave you.
We're not going to leave you hanging.
We're going to leave you with some tips and tricks
and how you can carry this on yourself.
We've been showing you tools week in and week out.
We show you one tool you can play with this weekend.
Well, now we're going to show you,
instead of giving you a fish,
we're going to try and teach you how to fish a little bit.
But really, I think most of you are probably more educated
than I am on a lot of this stuff. But we're here to share together. So hop in the chat. I would
love for you to participate today. Share with me what kind of tips you've learned along the way.
But today we are going to talk about these privacy services, not just privacy, but really any
cloud service that we use or any service we use in general that tells us, hey, just trust me,
your data is safe. The whole trust me bro phrase that we hear tossed around. And then we find out
later that maybe our data wasn't as safe as we thought it was. So that is what we're going to
be digging into today. I'm waiting for this to show up on zap.stream because I want to
post about it on Noster.
Zap.stream has just been behaving weird lately, unfortunately.
I'm not seeing it.
Now it's giving me an error.
All right, well, maybe I crashed ZapStream.
Who knows?
All right, well, we are live anyways.
We're live on X, TFTC X.
We're live on TFTC YouTube.
We're live on my own X.
And we should be live on zap.stream, but who knows if we truly are.
So thanks for joining in.
Let's go ahead and dive in.
Those who are catching up late, you can just hit 2X and listen to me on 2X
because, frankly, that is so much better than listening to somebody on 1X.
People talk so slow when you slow down the podcast to 1x.
So sometimes tuning in live is not preferential because you end up like just being like, come on, please talk faster.
OK, people sound weird, too.
Sometimes I feel like they actually are talking slower than they do in real life.
Let me go and share my screen.
We're going to dive in.
We're going to hit all sorts of stuff today.
We're going to talk about VPNs.
We're going to talk about AI.
We're gonna talk about just in general services that you use email services anything that claims to treat your data correctly with
encryption with security with
You name it they claim that they are not spying on you
Well, we're gonna talk about like are you they just ask you to trust them or do they give you ways to verify that yourself?
So that's what we're gonna do BTC pins. Good morning, bud. Welcome in
All right, let me share my screen.
There we are.
Okay, all right, we are viewing my screen here.
We got 10 viewers so far on YouTube.
How are we doing over on X?
I just want to make sure that I'm catching everybody here.
Give me my...
There we go.
All right.
We've got a couple hundred people watching.
Great.
Restream is not giving me correct stats, so I just won't trust Restream.
I'm going to go with what my own eyes are telling me.
Trust me, bro.
All right, the stats aren't even correct.
Okay, so what prompted this today?
It's a topic that I've been thinking about for a little while, but Luck T, sorry, man,
you're not the first comment.
You got a GM from BTC pins right ahead of you.
But hey, thanks for commenting anyways.
Welcome in.
Those of you who are here on the TFTC channel, hang around.
Right after me is RHR, Rabbit Hole Recap.
it's always a banger so what prompted this is Shawn Yeager on primal on
Noster shared this morning about anthropic and that they've made some
changes to their data retention policies and I left this up because there's these
ads drive me crazy please disable your ad blocker please me
familia you heard us when you don't okay whatever
Anthropic users face a new choice opt out or share your chats for AI training
so Anthropic is making a change on September 28th they're going to be
retaining conversations to train the AI models frankly I thought this was
already happening but there is a new toggle now that you can switch in fact
Let's go to Anthony's ex page if it'll let me when I'm not logged in.
Well the not logged in experience is different than being logged in so
whatever. Anyways, yeah there's a toggle now in settings that you have to go
in to opt out and turn off tracking but oh it's right here look at that you can help improve
claude oh do your do your service do your duty right um turn that off if you don't want them to
log your chats to help improve their ai right and then updates on retention i believe they're also
saving it for five years let me just search for the word five there we go extended data retention
we are also extending data retention to five years if you allow us to use your data for model
training, this updated retention length will only apply to new or resumed chats and coding
sessions and will allow us to better support model development and safety improvements.
Okay, some of you might be like, I don't use Claude.
Like, what the heck is Claude, right?
Most people talk about ChatGPT.
Claude is what almost every AI programmer uses now.
Claude code has quickly become the standard for using AI in your coding efforts.
It's used at huge companies as well as small companies.
And so Claude is collecting all of the proprietary code that is being written,
the code that gets written and then maybe thrown away,
and then new code that's written.
They're collecting it all, like everybody's source code,
and they're going to train their models off of it.
So there's a lot going on here.
And yes, they also have regular chat where people can chat about anything,
but they're expanding this.
And who knows, to say they'll stop at five years,
And also if that data is retained,
it is now sitting on their servers
and could be leaked out onto the internet at any moment.
We got a comment in here.
Tom Lee just gave an interview
claiming that Ethereum could overtake Bitcoin.
Okay, whatever.
So, you know, they have your data.
It could be leaked online.
How would it get leaked online?
They're very secure.
The servers are super secure.
Well, you might remember a couple stories here.
Where is it?
Okay.
Both ChatGPT and Grok.
Man, don't you love all these pop-ups?
ChatGPT and Grok accidentally allowed Google
to index some of the chats.
Now these weren't chats
that you were just having by yourself.
It was if you hit the share button
to send the chat to somebody else.
That ended up getting indexed on Google
and available on Google search results.
That was not surface to the user
as being a byproduct of hitting the share button.
The share button was giving you a private link
that you could text to somebody or email to somebody, right?
And it was meant to be a one-to-one,
I am sharing this chat with you.
So there were people who were having very like
deep conversations with ChatGPT and Grok
about all sorts of things, right?
Marriage advice or, you know, squabbles or who knows what,
but those were being indexed by Google
and then somebody would go search
and your potential name, your details
of what was going on in your life are now on Google.
So they have since backtracked and turned that off,
but then it was funny because those ended up
on archive.org as well,
and so then they had to go to archive.org
and get them all removed.
The underlying base principle here is that
if somebody else has your data, it can get out.
You have no control over what they do with that data.
Sure, they might have policies in place.
Sure, maybe you could go sue them
if you want to get a lawyer involved,
but that's like damage control after the fact.
Wouldn't you rather do preventative upfront?
So another example of this is ChachiBT is in a big lawsuit
with the New York Times right now,
and it might result in OpenAI
having to retain user data longer.
For example, if you use the temporary chat feature
inside of ChatGPT, I put air quotes around it
because it's not temporary.
They retain that information for 30 days.
So your chat that you do there is retained for 30 days.
And then this lawsuit is saying that they might have
to keep it for 90 days or indefinitely.
It's still back and forth, but they call it temporary.
And all that means is that it just doesn't show up
in your history and your sidebar,
but it stays on their servers
and could be stored into a backup somewhere
and that could eventually get leaked out.
A lot of these data hacks that we see that happen online
are actually people hacking into the backup servers
and stealing the backups.
They're not getting the live in-flight data.
Those backups are very juicy,
full of lots of treasure trove of information.
Okay, cool.
Let's, let me, I'm gonna hop over to just,
I wanna keep watch of the chat.
Restream is not giving me everything.
So, okay.
I just wanna make sure that I've got them all open here.
Cool.
Back to where we were.
So let's keep walking through here.
That was Anthropic.
Okay.
So what do we have here?
Oh wait, this is what I wanted to click on.
Wrong one.
So we have these things with VPNs
where VPNs claim that they don't log our data.
They're not keeping track of what we do.
It's a natural thing to say,
hey, if my internet service provider
is tracking all of my browsing history,
then I will use a VPN
and then I will hide my browsing history from them.
That's great.
If you look in the fine print
of your internet service provider,
It is buried in there that they are keeping track of all of your data.
I don't know if there are any that don't.
They claim they do it for legal reasons, but they also do it for lots of other reasons,
like selling your data to third-party advertisers, which usually means also selling your data to governments.
So people use VPNs to get around that.
They also use it to get around maybe something that their government has imposed on their country.
If you have a company firewall, we're seeing this right now, really hot topic in the UK
where they're saying that for child safety reasons, you should not use VPNs because they
want to put a gate on the internet in the UK where you have to verify your age in order
to go on the internet and access certain websites.
What that means is they just want to do, excuse me, let me get a drink here.
They just wanted to know your customer identity verification.
And eventually that leads to they control who can and cannot access the internet,
who can and cannot access information.
So VPNs are a big topic there.
And they're coming out saying, oh, please don't use VPNs.
Every time you use a VPN, you're hurting a child.
It's the same old recycled FUD.
Okay, so Torrent Freak is a website that's used by people
who have been sharing files online for years and years,
but they do this annual post where they email out
to all the VPN providers and they want to ask,
what are your security processes for your VPN?
And the biggest question that people really care about is,
do they keep logs of browsing activity?
Can I trust this VPN?
You know, all the questions are around, can I trust you?
Number one, do you keep any data that would allow you
to match an IP address or timestamp
to a current or former user of your service?
If so, exactly what information do you hold
and share for how long, right?
What is the name under which your company's incorporated?
What tools do you use to monitor and mitigate things?
What external email providers,
analytics support tools do you use?
So they go through all this stuff.
It's really, really fascinating stuff.
If you want to scrutinize a company,
I would highlight and copy and paste this
into a notes document you have.
My goodness, sorry.
Into a document and kind of ask yourself these questions
when you go look at another service.
You might not be able to get answers to these questions
when you use their service,
but you're thinking about it, right?
For example, support.
If you need to interact with their support, what third-party service are they using?
Because your email address will likely be tracked there.
And then if you engage with the support person and share any personal information about your account,
that is now going to be stored on that third-party service as well.
And could that data be pieced together to invade your privacy?
Things to think about that a lot of people just don't consider.
Because we've really grown up with this cloud computing phase that we're in right now. We've just grown to just trust everybody
They say they have military-grade encryption on their website. So we just trust that nothing bad is gonna happen and
A lot of the times we think that incentives are aligned and they have been fairly aligned, right?
Like companies want to continue to operate and if they screw over their users, they're gonna go out of business
That's the free market version of it
However, we see data breaches pretty much every day pop up in the news and a lot of companies recover from those data breaches
And so that's that's simply not enough anymore to just trust a company with your data. You need to do something more
We need to verify we need to have ways to verify that
Your data is safe. So I went and asked maple
Maple is our private AI and we we follow don't trust verify
We give you the verify ability that the ability to go verify for yourself that we are
Not tracking you and not logging your data that kind of stuff
But I asked it sorry, excuse our tables are kind of screwed up. We got to fix that
I asked it for examples of times where there were VPNs that said that they were not
Logging user data and not tracking user data
but then it was later exposed that they were and so they pointed out a couple things to me one of them was a
a company called PureVPN.
This was back in 2017.
NordVPN putting up an ad on this article,
which NordVPN is the next one we're going to look at.
That's a bit funny.
But NordVPN back in 2017,
they had all over the website that they don't keep logs
and that kind of stuff.
But then it came out that they indeed were.
So PureVPN was recently caught red-handed
further records from PureVPN show that the same email accounts, Lynn's Gmail and
the Teleport FX Gmail account were accessed from the same security blah
blah blah so they were keeping track of IP addresses. You can go back and look at
this more yourself. But they said hey please trust us and then they weren't
doing what they told you to trust them about. NordVPN, another big person
claiming that they don't track stuff. They weren't caught like that. So I'm not going to say that
they have been keeping user logs, but somebody gained access to one of their servers and was
watching traffic come through. And they were in flight. They were tracking a little more
information than maybe people thought they were. And so that hacker was able to get some personal
information, IP address information from users. You can go look at the Verge article about this
if you want to learn more about it. So yeah, NordVPN reveals server breach that could have
led attacker monitor traffic. NordVPN, because of this, has been doing third-party audits. So
the company's fifth audit is an important trust signal to current potential users that it really
isn't logging your traffic. So they went to Deloitte, which is one of the big four accounting
firms that do audits all over the world. And this is their solution. And this is frankly the
solution for a lot of companies. They say, hey, trust us. And we're going to get somebody to come
and look at the code. And then they're going to say that the code is good. So you can trust us
because you can trust them. And if that's the model you want to operate on, you can do that.
I'm not telling you, maybe I did already, but I'm trying not to tell you what's right and what's
wrong. I'm trying to give you the tools here and you can choose what is your risk profile and what
are you comfortable with. So if you're comfortable with trusting a third-party accounting firm that
has an IT audit department, if they say it's good, then you trust them. Then that's another
element you can put in, you know, another fact, another piece of information you can put into
your formula. I do want to remind everybody if you go search about Enron and Arthur Anderson,
Enron in 2001, it was one of the biggest energy providers in America and was committing all sorts
of fraud. And Arthur Anderson was the accounting firm that was auditing them and publishing
positive reports that Enron was doing fine and that we could trust them.
Well, both Enron and Arthur Anderson went down because they were caught committing fraud together.
So I'm not saying Deloitte and others are doing that, but there's a history of where people say that you can trust them, and then maybe they weren't doing exactly what you say.
Apple last year launched their Apple private cloud compute,
and they're really pushing.
Apple pushes privacy really hard,
and they've had some public spats,
like famously with the FBI back in 2015.
They wouldn't unlock a phone for the FBI.
I think it was 2015.
They would not push a new firmware update
to put a back door in.
So when they launched private cloud compute,
they want to provide people with transparency,
Their version of verifiable transparency is that they are making the images that they run on their servers
Making them available to third-party researchers and then the researchers will audit and let us know that it's okay
So again you as user have to trust
That Apple's providing the right images and that the researchers are saying that these are in fact
fine
mechanisms exist, such as Intel SGX and AWS Nitro attestation. Hey, oh, that's what we're
using at Maple. So I want to kind of end here. We've been going for 21 minutes now. I need
to vacate the channel soon so that Rabbit Hole Recap can jump in. But I want to talk
about we are in this new age now of AI companies that are giving all sorts of different privacy
security guarantees. The biggest ones, ChatGPT, Anthropic, they have policies where if you pay
them more money, if you pay them a lot of money, they will do what's called zero data retention,
ZDR for short. They claim that they are not going to keep any of your stuff. So if we search
chat GPT, oh let's just do this.
Tell me about chat GPT ZDR.
I'm gonna look up pricing.
It's a shorthand for an internal project, let's see.
I don't know, oh I didn't understand what I meant.
Classic.
Zero data retention policy.
OpenAI's own open model.
Didn't know what ZDR meant.
Okay, what is it and why does it matter?
Oh man, we really gotta fix these tables.
Sometimes called a no store or data purge on exit policy
is a set of rules and technical controls
that ensure an organization does not keep
any user generated or processed data
after a defined point of completion.
Okay?
That's key right there.
This data is still passing through the servers.
If you are a company, an organization that deals with highly sensitive information, and
you sign up with OpenAI for a zero data retention plan, which -- that's the API pricing.
Just give me chat GPT pricing.
Why is it so hard to get pricing sometimes?
ChachiBT.com slash pricing.
Whatever.
My goodness.
Okay, well, you have to pay for an enterprise plan.
You have to pay for these higher level tiers.
I'm pretty sure it's an enterprise plan.
It's been a little bit, but you have to pay for one of those.
Give them a lot of money, and then they will give you zero data retention.
What that means is after your data has passed through those servers and, you know, potentially been logged all over the place, they simply will not hit save at the end on their servers.
There are all sorts of opportunities for bugs along the way, right?
some data could be logged in some console somewhere on servers, and then those logs are
backed up and saved for data bugging purposes, right? If they have to triage and look at
something that happened, they can go back and dig through those logs. So they might be saving those
logs for very good reasons, but they're like, hey, these logs don't have any PII in it, personal
identifiable information, or maybe they say these logs don't have any ZDR data in them,
so we're going to save these forever if we want to.
But maybe they push a bug and it accidentally saves some ZDR data for a while and they don't
realize it, right?
Or maybe they go back and clean up after the fact and they don't get it all.
Your sensitive data is still passing through the servers and could be inspected or saved
at any moment.
You simply just have no idea.
they're not even keeping their promise, right?
I'm not saying that ChatGPT is doing this,
but the possibility is there
that they are saving your data,
even the ZDR data, that they're saving it somewhere.
And we have no way of verifying.
Okay.
So what we do at Maple is that
we basically give you ZDR by default
and we let you verify it.
So actually I'm not gonna do that.
I have a different window open here.
Okay.
So with Maple, we say that we are private AI chat
that's truly secure.
We're using secure enclaves,
we're using confidential computing,
and we have open source code that you can run to prove it.
There are other providers out there.
I don't wanna name names.
I'm really trying hard to say all of us privacy AI people
are gonna lift this, all boats are, you know,
we're gonna lift this water level together
so all the boats can rise together.
We really need to be going after the big people
who are not even doing this at all.
But publishing your open source code
doesn't fully mean that you are verifiable.
Unless people can see what's running on the servers
and use cryptographic proof
of what you're running on the servers,
then open sourcing your code will only get you so far.
Anybody can publish code
and then when they go to deploy it to the servers,
add stuff back in and deploy that to the servers.
In fact, that happens all the time,
not for nefarious reasons, but they change build numbers
or they change little things here and there
as part of the deployment process.
And that stuff doesn't make it into the open source code
because one, it doesn't need to for some reason,
or two, there is security stuff in there
that they don't want to maybe publish open source.
So there are reasons why code would get changed
before it's deployed, but they could also be
putting other stuff in there that is tracking your stuff.
So we give people the ability to prove it.
You just click on proof here
and we show you the attestation.
And this is what Apple was referring to
in their blog posts if we go back.
Some specialized mechanisms exist, AWS Nitro attestation.
So this is like a fingerprint of the server
where this is the code that was deployed on the server.
And then you can go to github.com.
Actually, let's just click on it in here.
Why am I typing that?
Just go to our GitHub, okay, and go to Maple.
You also can look at our Open Secret server code.
But you can run the code yourself.
While you're there, click a star, star us.
It helps us out.
But yeah, you can go to Open Secret,
you can build the code,
you can get that same attestation fingerprint thing,
right, checksum,
and you can compare those two to each other.
We also give you all the attestations for the full stuff
for the AWS hardware as well.
What this all means
is you're getting hardware level encryption.
So we're publishing our code open source,
and then we say this code is running on a server
with this secure enclave, this secure chip.
And that chip is encrypted.
And the memory that's running,
the RAM that's running on that server is encrypted.
So people are not able to access it.
The only thing that can look at that memory
is the code that is running.
And how do you know if you can trust the code
that is running?
Well, it is this code right here on GitHub.
You can go see it for yourself
and you can see that there are no logs happening.
You can see that there's no data being stored,
all that good stuff, right?
So this is, sure, you can call this a pitch
for what we're doing, but really,
we are taking these tools, these basic principles,
and we are applying them to how we do security at Maple,
because we don't want to keep track of our user data.
We don't want our user data.
So when you use Maple, it's your data.
You have a private key that encrypts your data
on your device before it is sent to our servers,
And then on our servers, the only thing that interacts with your data in a way that it can be read is the enclave.
And that's the enclave on the CPU side where it's handling the encryption back and forth.
And then on the GPU side, we have GPU providers that also use secure enclaves.
And your code, sorry, not your code, your chats and your data, your personal information is sent encrypted to the GPUs.
And then in the enclaves, it's decrypted.
The AI accesses it, comes up with a response, re-encrypts it, and then sends it back to your device where it is decrypted on your device.
At no point in time do we have access to your data when it is unencrypted.
It's always encrypted.
So that's what we give you.
And this is our don't trust, verify model.
We don't ask you to just trust us, bro.
Really, the only thing that you're trusting is this hardware encryption on the chip that is being run inside of AWS and at our GPU providers.
Now, if that's too much for you, you don't want to trust that, you can run AI locally.
There are so many great AI tools run locally.
I've done an episode on this to show you how to do that.
If you need that level of security, that is the best.
Run it on your own.
Turn off the internet.
Run on a server that's not going to connect to anything and do that.
But if you want to have AI that is available everywhere, if you're using ChatGPT right now,
if you're using Grok and you have a free account on there or even a paid account,
go to Maple and get a free account.
It doesn't cost you anything.
And you're going to get infinitely better security guarantees than you would with ChatGPT
and Claude and Grok.
We just went through some of the stories as to why you shouldn't potentially trust them
or why you should verify before you trust them.
So anyways, that's where I'm going to end it today.
Don't trust, verify.
Every service you look at, when you go to the security page,
when you go to, you know, why you should trust us,
start looking at it through this new lens of,
is there a way for me to verify the code that is running on their servers?
And start looking at, like, what other tools are they sharing my data with
for their internal practices?
Go back to that Torrent Freak article if you want to,
and they have these 12 questions that they ask everybody.
what political pressure is on that company, you know, based on the country that they operate in.
There's all sorts of great things to just be thinking about. Be thinking about these as you
access different services. And I'm going to bid you farewell from season one of Freedom Tech
Weekend. If you are just tuning in right now, this is the end of season one. This is episode 21 of
season one of Freedom Tech Weekend. It's been a blast being along here with everybody. Thanks for
joining in. Thanks for tuning in week in and week out. The only week I missed was last week,
but things are getting really busy right now. So we're approaching a thousand viewers here
live. Thank you for joining us. Go back and catch the beginning of the episode.
Don't trust bros. Just verify instead. All right. Stick around if you're on the TFTC channels
for Rabbit Hole Recap. If you're on my channel, hop over to TFTC, go check out Rabbit Hole Recap.
And I hope that you have a great weekend.
And go over to trymaple.ai and get yourself a free Maple account.
All right.
Later.
Thank you.