Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 106 posts

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#71

Post by threeseed »

julesdrean wrote: post #46
candiddevmike wrote: post #43

Earlier quoted context omitted.

GCP, yes: https://cloud.google.com/confidential-computing/confidential...

Azure and GCP offer Confidential VMs which removes trust from the cloud providers. We’re trying to also remove trust in the service provider (aka ourselves). One example is that when you use Azure or GCP, by default, the service operator can SSH into the VM. We cannot SSH into our inference server and you can check that’s true.

But nobody wants you as a service provider. Everyone wants to have Gemini, OpenAI etc which are significantly better than the far smaller and less capable model you will be able to afford to host.

And you make this claim that the cloud provider can SSH into the VM but (a) nobody serious exposes SSH ports in Production and (b) there is no documented evidence of this ever happening.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#72

Post by FrasiertheLion »

threeseed wrote: post #71
julesdrean wrote: post #46

Earlier quoted context omitted.

Azure and GCP offer Confidential VMs which removes trust from the cloud providers. We’re trying to also remove trust in the service provider (aka ourselves). One example is that when you use Azure or GCP, by default, the service operator can SSH into the VM. We cannot SSH into our inference server and you can check that’s true.

But nobody wants you as a service provider. Everyone wants to have Gemini, OpenAI etc which are significantly better than the far smaller and less capable model you will be able to afford to host. And you make this claim that the cloud provider can SSH into the VM but (a) nobody serious exposes SSH ports in Production and (b) there is no documented evidence of this ever happening.

We're not competing with Gemini or OpenAI or the big cloud providers. For instance, Google is partnering with NVIDIA to ship Gemini on-prem to regulated industries in a CC environment to protect their model weights as well as for additional data privacy on-prem: https://blogs.nvidia.com/blog/google-cloud-next-agentic-ai-r...

We're simply trying to bring similar capabilities to other companies. Inference is just our first product.

>cloud provider can SSH into the VM

The point we were making was that CC was traditionally used to remove trust from cloud providers, but not the application provider. We are further removing trust from ourselves (as the application provider), and we can enable our customers (who could be other startups or neoclouds) to remove trust from themselves and prove that to their customers.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#73

Post by madars »

This is fantastic. One rarely discussed use case is avoiding overzealous "alignment" - you want models to help advance your goals without arbitrary refusals for benign inputs. Why would I want Anthropic or OpenAI to have filtering authority over my queries? Consider OpenRouter ToS - "you agree not to use the Service [..] in violation of any applicable AI Model Terms": not sure if they actually enforce it but, of course, I'd want hardware security attestations that they can't monitor or censor my inputs. Open models should be like utilities - the provider supplies the raw capability (e.g., electrons or water or inference), while usage responsibility remains entirely with the end user.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#74

Post by threeseed »

FrasiertheLion wrote: post #68
rkagerer wrote: post #65

What's your revenue model? The pricing page implies you're basically reselling access to confidential-wrapped AI instances. Since you rightly open-sourced the code (AGPL) is there anything stopping the cloud vendors from running and selling access to their own instances of your server-side magic? Is your secret sauce the tooling to spin up and manage instances and ease customer UX? Do you aim to attract an ecosystem…

>Since you rightly open-sourced the code (AGPL) is there anything stopping the cloud vendors from running and selling access to their own instances of your server-side magic? Sure they can do that. Despite being open source, CC-mode on GPUs is quite difficult to work with especially when you start thinking about secrets management, observability etc, so we’d actually like to work with smaller cloud providers who want…

> Confidential computing has been around a while, and we still don’t see widespread adoption of it, largely because of the difficulty

This is not the reason at all. Complexity and difficult are inherent to large companies.

It's because it is a very low priority in an environment where for example there are tens of thousands of libraries in use, dozens of which will be in Production with active CVEs. And there are many examples of similar security and risk management issues that companies have to deal with.

Worrying about the integrity of the hardware or not trusting my cloud provider who has all my data in their S3 buckets anyway (which is encrypted using their keys) is not high on my list of concerns. And if it were I would be simply running on-premise anyway.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#75

Post by threeseed »

max_ wrote: post #32

The only way to guarantee privacy in cloud computing is via homorphic encryption. This approach relies too much on trust. If you have data you are seriously sensitive about, its better for you to run models locally on air gapped instances. If you think this is an overkill, just see what happened to coinbase of recent. [0] [0]: https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed...

> The only way to guarantee privacy in cloud computing is via homorphic encryption

No. The only way is to not use cloud computing at all and go on-premise.

Which is what companies around the world do today for security or privacy critical workloads.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#76

Post by 3s »

madars wrote: post #73

This is fantastic. One rarely discussed use case is avoiding overzealous "alignment" - you want models to help advance your goals without arbitrary refusals for benign inputs. Why would I want Anthropic or OpenAI to have filtering authority over my queries? Consider OpenRouter ToS - "you agree not to use the Service [..] in violation of any applicable AI Model Terms": not sure if they actually enforce it but, of cour…

That's a big reason why we started Tinfoil and why we use it ourselves. I love the utilities analogy, something that is deeply integrated in business and personal use cases (like the Internet or AI) needs to have verifiable policies and options for data confidentiality.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#77

Post by threeseed »

FrasiertheLion wrote: post #72
threeseed wrote: post #71

Earlier quoted context omitted.

But nobody wants you as a service provider. Everyone wants to have Gemini, OpenAI etc which are significantly better than the far smaller and less capable model you will be able to afford to host. And you make this claim that the cloud provider can SSH into the VM but (a) nobody serious exposes SSH ports in Production and (b) there is no documented evidence of this ever happening.

We're not competing with Gemini or OpenAI or the big cloud providers. For instance, Google is partnering with NVIDIA to ship Gemini on-prem to regulated industries in a CC environment to protect their model weights as well as for additional data privacy on-prem: https://blogs.nvidia.com/blog/google-cloud-next-agentic-ai-r... We're simply trying to bring similar capabilities to other companies. Inference is just our f…

You are providing the illusion of trust though.

There are a multitude of components between my app and your service. You have secured one of them arguably the least important. But you can't provide any guarantees over say your API server that my requests are going through. Or your networking stack which someone e.g. a government could MITM.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#78

Post by osigurdson »

Here is a marketing campaign for you to prove that secure enclaves work.

Host a machine on the internet. Allow competitors to sign up to receive root ssh credentials. Offer a $10K prize if they are able to determine plaintext inputs and outputs over a given time period (say one month).

A bit of a strawman, but a competition like this might help build confidence.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#79

Post by FrasiertheLion »

osigurdson wrote: post #78

Here is a marketing campaign for you to prove that secure enclaves work. Host a machine on the internet. Allow competitors to sign up to receive root ssh credentials. Offer a $10K prize if they are able to determine plaintext inputs and outputs over a given time period (say one month). A bit of a strawman, but a competition like this might help build confidence.

That's exactly our plan for Defcon next year as Nate just mentioned: https://news.ycombinator.com/item?id=44000103

But making it a public competition is a fantastic idea.

Re: Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI

#80

Post by osigurdson »

threeseed wrote: post #77
FrasiertheLion wrote: post #72

Earlier quoted context omitted.

We're not competing with Gemini or OpenAI or the big cloud providers. For instance, Google is partnering with NVIDIA to ship Gemini on-prem to regulated industries in a CC environment to protect their model weights as well as for additional data privacy on-prem: https://blogs.nvidia.com/blog/google-cloud-next-agentic-ai-r... We're simply trying to bring similar capabilities to other companies. Inference is just our f…

You are providing the illusion of trust though. There are a multitude of components between my app and your service. You have secured one of them arguably the least important. But you can't provide any guarantees over say your API server that my requests are going through. Or your networking stack which someone e.g. a government could MITM.

I don't know anything about "secure enclaves" but I assume that this part is sorted out. It should be possible to use http with it I imagine. If not, yeah it is totally dumb from a conceptual standpoint.
Post reply on HN