Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private Cloud Compute: A new frontier for AI privacy in the cloud

security.apple.com

Post reply on HN
Print view View original

31–40 of 393 posts

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#31

Post by zer00eyz »

I have a big question here.

Who is this for? Dont get me wrong I think it's a great effort. This is some A+ nerd stuff right here. It's speaking my languge.

But Im just going to figure out how to turn off "calls home". Cause I dont want it doing this at all.

Is this speaking to me so I tell others "apple is the most secure option"? I don't want to tell others "linux" because I don't want to do tech support for that.

At this point I feel like an old man shouting "Dam you keep your hands off my data".

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#32

Post by 7e »

jeffbee wrote: post #4

A lot of this sounds like Apple has been 10-20 years behind the state of the art and now wants to tell you that they partially caught up. Verifiable hardware roots of trust and end-to-end software supply chain integrity are things that have existed for a while. The interesting part doesn't come until the end where they promise to publish system images for inspection.

This is not true at all. Apple is the first to roll out end to end remote attestation of an enclave that includes an ML accelerator in the root of trust, with public verifiability of the entire stack. They are way ahead.

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#33

Post by transpute »

cherioo wrote: post #25

Can some ELI5 how remote attestation is supposed to work? It feels like asking a remote endpoint “are you who you say you are”. What’s stopping remote endpoint always responding “yes”

> What’s stopping remote endpoint always responding “yes”

It requires a small, trusted remote observer hardware component, e.g. TCG TPM/DICE, Apple Secure Enclave, Google OpenTitan, Microsoft Pluton.

2021 literature review, https://arxiv.org/abs/2105.02466

2022 HN thread on remote attestation, https://news.ycombinator.com/item?id=32282305

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#34

Post by m-s-y »

Havoc wrote: post #15

Sounds good. Still won’t send anything sensitive there but I appreciate the effort and direction, especially when current industry trend seems to be fuck you were rewriting our TOS to take your data.

Apple’s doing this specifically to avoid the possibility of what you’re describing.

The transparency & architecture together are intended to be more than enough to publicly detect any major retooling of the system.

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#35

Post by sodality2 »

bowmessage wrote: post #9
ethbr1 wrote: post #5

Earlier quoted context omitted.

Do you have analogous search terms for Microsoft, Alphabet, Google, and Amazon's approaches? Your comment makes me curious on how guarantee-to-guarantee looks (and associated architectures).

https://cloud.google.com/docs/security/binary-authorization-... is one example

None for consumer-facing products, though

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#36

Post by SirensOfTitan »

What I'm most curious about here is if a state actor comes to Apple with a subpoena and compels them to release information on an individual, what would Apple be able to release?

... I suppose this is ultimately a question that will be tested sooner or later in the US.

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#38

Post by stensonb »

threeseed wrote: post #28
ignoramous wrote: post #20

Earlier quoted context omitted.

> could be the first time we'll see a big tech company actually provide an auditable security guarantee AWS Nitro Enclaves [0] come close but of course what Apple has done is productize private compute for its 1b+ macOS & iOS customers! [0] https://docs.aws.amazon.com/enclaves/latest/user/nitro-encla...

You would combine that with AWS BottleRocket: https://aws.amazon.com/bottlerocket

Absolutely looking forward to that possibility: https://github.com/bottlerocket-os/bottlerocket/issues/3348
Post reply on HN