Who's listening? Growing privacy concerns around transcription services (2020)(rrj.ca)
rrj.ca
Who's listening? Growing privacy concerns around transcription services (2020)
https://rrj.ca/whos-listening/
45 comments
This "privacy concerned" app has a myriad of analytics and tracking scripts which can read the transcript in local storage or log key presses (but are hopefully not be configured that way). Typical privacy friendly defaults like google analytics anonymize_ip are not set. There are no checks for the integrity of these third party scripts (a hack against them can lead to a breach of the app) and it does not ask for consent before connecting the user to these third party servers. There is also an error logging service (datadog) and i have seen other apps push all state info, including local storage and auth tokens, when any error happens. The promise of the recording and transcript not leaving the users computer in local-only mode may be true, if its implemented correctly.
The privacy policy looks halfway decent, a bit chaotic with no ToC and free-floating "legal basis" & "retention policy" that are independent from the concrete processing tasks, leaving them as abstract "we know the law" blocks of little value. The policy is very dominated by all the user behavior tracking and ad-tech integrations, while the processing of recordings/transcriptions is rather short. In a way that is good, but it is almost too short, given that it is the primary function: "transcripts" and "recordings" are not even a category of data in their policy, and they are not mentioned with any sub-processor, not even by the ones running the servers (a rather curious formal error, as one would assume a focus on their core business). There is a complete lack of "we keep small samples to improve the ML/AI" which i find inteersting, but which might be true.
There is a small note in the legal texts that the user must have the consent of the recorded people before uploading recordings to the server for automatic transcriptions, but there does not seem to be one in proximity to the upload function. (or at least they are missing from the screenshots in the guides, i did not register for a trial)
The privacy policy looks halfway decent, a bit chaotic with no ToC and free-floating "legal basis" & "retention policy" that are independent from the concrete processing tasks, leaving them as abstract "we know the law" blocks of little value. The policy is very dominated by all the user behavior tracking and ad-tech integrations, while the processing of recordings/transcriptions is rather short. In a way that is good, but it is almost too short, given that it is the primary function: "transcripts" and "recordings" are not even a category of data in their policy, and they are not mentioned with any sub-processor, not even by the ones running the servers (a rather curious formal error, as one would assume a focus on their core business). There is a complete lack of "we keep small samples to improve the ML/AI" which i find inteersting, but which might be true.
There is a small note in the legal texts that the user must have the consent of the recorded people before uploading recordings to the server for automatic transcriptions, but there does not seem to be one in proximity to the upload function. (or at least they are missing from the screenshots in the guides, i did not register for a trial)
A post on HN yesterday said Local Storage is not secure from XSS attacks.
And that's fine right? If it was a desktop app instead, you could say that it's not secure against sandbox escapes and stack smashing attacks. It's still a step-up in security compared to cloud transcription services, and for most use cases perfectly adequate.
Thanks for sharing. Just read through it and like one of the comments mentioned, if malicious JS is able to run on any site, that’s a larger issue and would affect not just local storage right?
Someone would have to make specific JS to target your specific app/service and specific users, as well as in some way "launder" the stolen data. Totally different 'order of magnitude' from automatically and legally taking the users' data.
I hope this is the correct way to evaluate these kind of things?
I hope this is the correct way to evaluate these kind of things?
Can anyone provide an update on the state of open-source transcription packages, with language models? I'd love to have the equivalent of spaCy, gensim, Stanford NLP, or NLTK, but for transcription. That is, packages that will just work at quality comparable to cloud transcription APIs if you generally know what you're doing but maybe don't keep up with the latest literature.
Vosk does a solid job, and there are a couple other alternatives. Trouble is, the bottleneck for quality here is dataset size/quality/availability, so closed-source models with private data have the leg up.
The main message here seems pretty straightforward and is only lightly related to transcription:
If you gather confidential information do not hand them over to some third party for transcription, storage, sync, cloud office solutions, etc.
I feel that this is quite a basic truth and packaging it in such a long essay makes me think that most people on HN might not be the articles target group.
It was still fun to read though.
If you gather confidential information do not hand them over to some third party for transcription, storage, sync, cloud office solutions, etc.
I feel that this is quite a basic truth and packaging it in such a long essay makes me think that most people on HN might not be the articles target group.
It was still fun to read though.
Pro tip: Jump to paragraph 11 to skip the life story of the random person and get to the point.
Starting with paragraphs of side-story primed my bullshit detector as well and it kept flagging this article: not only is there too much text that has little to do with the headline, the paragraphs that focus on the subject hide wild claims behind citations. "U.S. officials were reported to have said" is an honest attribution, but not a quality source. However, the author has to deal with the problem that rumors are all we have. There are no new facts in this article, it's a write up of what is known, garnished with tales of journalists at work, intended for those who are new to the topic. (Edit: skipping the first ten looses the explanation of "air-gapped device" and what "transcription" even is.)
The relevant key elements for the topic are all there: undisclosed third parties, outsourcing to cheap labor, spy agency backdoors, governments wanting blanked access, subpoenas against sources and journalists, bad tech, bad laws, data breaches, hacks and overly broad clauses in the service contracts. But it is too shallow, not intended for those who already knew that and hoped for details and depth.
For a moment the article even hit my advertisement detection due to the way the "list of transcription services" at the end is formatted, how brand names are sprinkled in, how the author tries to avoid making it too one sided (which is a good thing!) and how the investigative journalists approach is related to overpacking and old fashioned motels. I suspected a bait and switch: bait with a cautionary tale, switch into a sales pitch. But the author says he does not endorse any of the named services and the short reviews focus on problems with their policies.
Overall i find it ok, even if it is a bit too heavy on the narrative of this journalist protects his sources, be like him for my taste.
EDIT: i ran the literal quotes through google and i think these are interviews backing the article as primary sources. This is no bullshit, it's good and honest work.
The relevant key elements for the topic are all there: undisclosed third parties, outsourcing to cheap labor, spy agency backdoors, governments wanting blanked access, subpoenas against sources and journalists, bad tech, bad laws, data breaches, hacks and overly broad clauses in the service contracts. But it is too shallow, not intended for those who already knew that and hoped for details and depth.
For a moment the article even hit my advertisement detection due to the way the "list of transcription services" at the end is formatted, how brand names are sprinkled in, how the author tries to avoid making it too one sided (which is a good thing!) and how the investigative journalists approach is related to overpacking and old fashioned motels. I suspected a bait and switch: bait with a cautionary tale, switch into a sales pitch. But the author says he does not endorse any of the named services and the short reviews focus on problems with their policies.
Overall i find it ok, even if it is a bit too heavy on the narrative of this journalist protects his sources, be like him for my taste.
EDIT: i ran the literal quotes through google and i think these are interviews backing the article as primary sources. This is no bullshit, it's good and honest work.
When the article starts like this one...:
> When Michael Lista went to stay 10 days at a lonely, one-storey motel in Emerson, Manitoba
...I immidiatelly close the site and make a mental note of the "dont open links from this site again".
Sometimes I wonder if I am the only one. I came to read info, not authors attempt at a short novel.
...I immidiatelly close the site and make a mental note of the "dont open links from this site again".
Sometimes I wonder if I am the only one. I came to read info, not authors attempt at a short novel.
Well the Magazine calls itself "[__] Review of Journalism" and many of the articles seem to start with a story about a specific journalist that is exemplary for the topic. It's a brand thing. If you really dislike it, then this magazine is not for you.
Personally this narrative oriented style has me on edge about rhetoric subterfuge. It feels like a sleight of hand, like a Kansas City shuffle, like a trick to fly fiction, an advertorial, or opinion below the radar.
Personally this narrative oriented style has me on edge about rhetoric subterfuge. It feels like a sleight of hand, like a Kansas City shuffle, like a trick to fly fiction, an advertorial, or opinion below the radar.
What's with the fad where articles start by describing how a random person overpacked? It's such a cliche by now, yet I see it everywhere.
>What's with the fad where articles start by describing how a random person overpacked?
Fyi, it's not a fad. It's what's called a "human interest" angle and some publications (like this rrj.ca website of this thread) have that editorial allowance for personal storytelling. (I made a previous comment about this: https://news.ycombinator.com/item?id=24270673)
More examples of that include "The New Yorker", "Harper's" and other literary style magazines.
The opposite examples of "just the facts" type of publishers would be "lwn.net" for Linux tech articles or The Economist magazine for business stories. You won't find articles beginning with personal things like, "When I was a little boy, my father took me to discover ice...blah blah blah...."
The problem is that HN is an aggregation site that gets the [human interest] articles when some readers don't want it and we have no convention for tagging them to avoid annoying that subset of the audience.
Fyi, it's not a fad. It's what's called a "human interest" angle and some publications (like this rrj.ca website of this thread) have that editorial allowance for personal storytelling. (I made a previous comment about this: https://news.ycombinator.com/item?id=24270673)
More examples of that include "The New Yorker", "Harper's" and other literary style magazines.
The opposite examples of "just the facts" type of publishers would be "lwn.net" for Linux tech articles or The Economist magazine for business stories. You won't find articles beginning with personal things like, "When I was a little boy, my father took me to discover ice...blah blah blah...."
The problem is that HN is an aggregation site that gets the [human interest] articles when some readers don't want it and we have no convention for tagging them to avoid annoying that subset of the audience.
Hmm, that's informative, thanks. I agree there's an expectation mismatch, but I also find the writing in those articles a bit formulaic. I guess I'm mostly annoyed because I'm expecting a "just the facts" style and getting "human interest" instead, but it's fair that there are people who prefer that style.
Any good sources on this kind of media "sausage making" meta detail?
I'm seriously thinking about a series of blog posts kind of diving a little bit into how news comes together. Any particular topics youre interested in?
Although I'd argue The Economist, while not having that form of literary style, does favor wordplay of various types so it's not really a great "just the facts" example. (Not a criticism in that I like their style in general.)
Have to pad those word counts when you're paid for length. If you don't have eyeballs on your website for X amount of time per visit, how are advertisers to know they got their money's worth?
> how a random person overpacked
This particular investigative journalist is over-preparing for interacting with sources. That is a literary device to color his avoidance of the services named in the headline.
This particular investigative journalist is over-preparing for interacting with sources. That is a literary device to color his avoidance of the services named in the headline.
We're story tellers with lives, perhaps it allows a person to feel like they're more than a cog in a wheel existing just to please some impatient internet stranger?
Communication is about co: sharing information that is wanted to be sent and wanted to be received. Readers aren't meant to be a captive audience for shaggy dog tales. The article is on the review of Journalism website, not a storytelling website.
Overpacking a story with junk (how ironic!) makes it harder to spread the important ideas of the article, which hurts the author's goal.
Overpacking a story with junk (how ironic!) makes it harder to spread the important ideas of the article, which hurts the author's goal.
Different people like different things. Rather than assuming the author, the editor, and various other reviewers are all idiots, perhaps consider that you are not representative of their typical audience.
That's a good point. I feel like there's essentially two groups: those that want the information and are annoyed by the stories, and those who want the stories. I don't know whether they'd read the article if it didn't come with a somewhat relatable story.
Unfortunately, many large media companies have adopted the story-first-facts-second strategy. Are those who prefer otherwise such a tiny minority?
To me, these articles look like those SEO recipe sites that are stuffed with random content because Google won't rank them as well if they just provided what the user is looking for.
Unfortunately, many large media companies have adopted the story-first-facts-second strategy. Are those who prefer otherwise such a tiny minority?
To me, these articles look like those SEO recipe sites that are stuffed with random content because Google won't rank them as well if they just provided what the user is looking for.
> there's essentially two groups: those that want the information and are annoyed by the stories, and those who want the stories
This assumes information can always be cleanly severed from the story. That strikes me like cutting a paper down to the abstract and conclusion. Yes, the methods may be tedious to get through, but someone with an understanding of them sees the problem with more depth.
This assumes information can always be cleanly severed from the story. That strikes me like cutting a paper down to the abstract and conclusion. Yes, the methods may be tedious to get through, but someone with an understanding of them sees the problem with more depth.
Certainly not always, sometimes you need the story context because it's about some particular thing happening.
But for a story about how chemical X is bad for your health, you don't need to read about Suzy and Michael, their new house, what they're going to name their baby and how they decided on painting the house in Suzy's grandmother's favorite color... to learn that some paint includes a chemical that is bad for your health.
I get the impression that there are multiple things at work: some people really like those side-stories, and they're very easy to write. You'd have a much, much harder time filling a newspaper with facts, which makes it much more expensive.
But for a story about how chemical X is bad for your health, you don't need to read about Suzy and Michael, their new house, what they're going to name their baby and how they decided on painting the house in Suzy's grandmother's favorite color... to learn that some paint includes a chemical that is bad for your health.
I get the impression that there are multiple things at work: some people really like those side-stories, and they're very easy to write. You'd have a much, much harder time filling a newspaper with facts, which makes it much more expensive.
> for a story about how chemical X is bad for your health, you don't need to read about Suzy and Michael, their new house, what they're going to name their baby and how they decided on painting the house in Suzy's grandmother's favorite color... to learn that some paint includes a chemical that is bad for your health.
But the story isn't chemical X is bad for you. It's about how Suzy and Michael, within a specific set of circumstances, had bad things happen after being exposed to chemical X.
Depending on who you are, those details could be important. If chemical X is known to be harmful, it opens up details into how Suzy and Michael got exposed and who exposed them. Is this a local problem or a national one? Are there alternative explanations for the bad things that have nothing to do with chemical X? The human interest details, meanwhile, clue you into socioeconomic and demographic factors which may be at play. (But also may not.)
These sorts of stories are surfacing anecdotes. Hopefully fact-checked anecdotes. But not peer-reviewed papers, either. (All that said, I personally prefer publications that tend towards terseness.)
But the story isn't chemical X is bad for you. It's about how Suzy and Michael, within a specific set of circumstances, had bad things happen after being exposed to chemical X.
Depending on who you are, those details could be important. If chemical X is known to be harmful, it opens up details into how Suzy and Michael got exposed and who exposed them. Is this a local problem or a national one? Are there alternative explanations for the bad things that have nothing to do with chemical X? The human interest details, meanwhile, clue you into socioeconomic and demographic factors which may be at play. (But also may not.)
These sorts of stories are surfacing anecdotes. Hopefully fact-checked anecdotes. But not peer-reviewed papers, either. (All that said, I personally prefer publications that tend towards terseness.)
> But the story isn't chemical X is bad for you. It's about how Suzy and Michael, within a specific set of circumstances, had bad things happen after being exposed to chemical X.
That's a very specific story then, and that's not what I'm talking about.
I'm talking about "eating poison is not good for humans". Suzy and Michael are humans, therefore eating poison is not good for them, but they could be replaced with any other human: they specifically don't add anything to the story. They're an emotional connection for the reader at best and a filler at worst.
That's a very specific story then, and that's not what I'm talking about.
I'm talking about "eating poison is not good for humans". Suzy and Michael are humans, therefore eating poison is not good for them, but they could be replaced with any other human: they specifically don't add anything to the story. They're an emotional connection for the reader at best and a filler at worst.
Indeed. To me, it's the age-old form vs function dichotomy. I have resigned myself long ago to the fact that most people choose form over function every time.
I found it's very liberating to consciously decide "this isn't intended for me" and focus my attention elsewhere. Still, it's very easy to lower my guard and fall into the mindless consumer trap again. But it's an indulgence, and I try to limit my intake.
I found it's very liberating to consciously decide "this isn't intended for me" and focus my attention elsewhere. Still, it's very easy to lower my guard and fall into the mindless consumer trap again. But it's an indulgence, and I try to limit my intake.
Valid point! Oddly enough, I'd rather read a bunch of comments _about_ the alleged article than actually _read the article_.
Perhaps if someone wrote a blog in nested-comment style I would read it.
Fun though experiment: could Harry Potter be rewritten in comment style?
Perhaps if someone wrote a blog in nested-comment style I would read it.
Fun though experiment: could Harry Potter be rewritten in comment style?
Oh, you know the author's goal? Likewise, if it was published on the site - arguably the curators read the article and approved it - but because it doesn't fit your own expectations of the only kind of content you want there, then it's inappropriate? That sounds like gatekeeping and perhaps perfectionism.
When I go to bed, I think about how I’m going to wake up next morning and have a hot cup of coffee, a marvelous breakfast and brush my teeth before sitting in the comfy armchair that I have next to the couch in my medium-sized living room. Then, when I wake up, I do all those things that I have in mind that I went to bed with, that I dreamed about while sleeping in my large wooden bed that I inherited from my grandmother who is not with us anymore.
I loved my grandmother, we’ve spent such a great time together as we used to do our daily walks in the green park in front of our house and we watched all those dogs running around and birds chirping, while enjoying our ice-cream that we had acquired from the shop around the corner.
Then I wake up, and I go on Hacker News to read about all those interesting and innovative things that happen around me all the time, while my little dog wags his tail and watches me as I click every link on the front page.
Thank you for reading this.
I loved my grandmother, we’ve spent such a great time together as we used to do our daily walks in the green park in front of our house and we watched all those dogs running around and birds chirping, while enjoying our ice-cream that we had acquired from the shop around the corner.
Then I wake up, and I go on Hacker News to read about all those interesting and innovative things that happen around me all the time, while my little dog wags his tail and watches me as I click every link on the front page.
Thank you for reading this.
But... you forgot to share your grandmother's recipe for making lemonade!
Thanks for writing it, whether in no, half or full jest - I appreciated it.
I concur.
I try to add as much “human” as possible into my writing and tech interaction.
I feel that we have allowed technology to leech our humanity, and the consequences have been devastating.
When we have people running multi-billion-node datasets, that have no empathy for the essential “humanity” of each node, we can have Jurassic-scale disasters.
I try to add as much “human” as possible into my writing and tech interaction.
I feel that we have allowed technology to leech our humanity, and the consequences have been devastating.
When we have people running multi-billion-node datasets, that have no empathy for the essential “humanity” of each node, we can have Jurassic-scale disasters.
Why going that deep, if one can just 'get to the point' from the title alone?
I would not comment, if it were somewhat disrespectful to the source and context of the article. It's a journalism oriented blog, and in this case, its target audience is practicing or student journalists. So the story is painted to relate to that audience's concerns.
Also giving such a 'Pro tip' is equal to teaching HN readers how to use scrolling...
I would not comment, if it were somewhat disrespectful to the source and context of the article. It's a journalism oriented blog, and in this case, its target audience is practicing or student journalists. So the story is painted to relate to that audience's concerns.
Also giving such a 'Pro tip' is equal to teaching HN readers how to use scrolling...
[deleted]
For air-gapped recordings the technique that one person mentions (locally record and make brief notes/timing of important parts of the conversation--there are devices that will do this semi-automatically) is probably the best approach.
I'd also note that ML transcriptions are useful in the context of this article, i.e. to get rough cheap transcripts. But, if you value your time above minimum wage, human transcription is a lot better if you actually want to publish a transcript of an interview.
I'd also note that ML transcriptions are useful in the context of this article, i.e. to get rough cheap transcripts. But, if you value your time above minimum wage, human transcription is a lot better if you actually want to publish a transcript of an interview.
And in some places, those are hard to avoid. My school in previous semester had a class that required online meetings that were recorded and transcriped with no way to opt out without affecting your grade. And explaining my beefs to professors is getting harder and harder ( ie. for an outside viewer it looks like I am not being reasonable ).
At https://audext.com/ your privacy and security are very important to us. All uploaded files are stored securely, are used exclusively for transcription and can be deleted manually or after a time limit.
Combine this with the article about brain-to-machine connections earlier today and you are deep in a privacy-nightmare dystopia.
We’ve been working on it for over a decade and we did add machine transcription recently, but I still find a surprising number of users use and ask about the local-only “Self Transcription” mode.
One interesting side-effect of a local-only mode is that we can’t sync transcript data between computers. And this sometimes surprises people. Once we explain that this is actually a feature not a bug, since we don’t store the data on our servers to be able to do the sync, it actually seems to reassure people even more.
[1] https://transcribe.wreally.com