cmhe

Usually sure, but as we see with drive assistants, getting more and more advanced, and potentially resist the control of the driver, then the manufacturer could become liable.

Question is: Who is the person controlling the AI?

The one that allowed the agent to do stuff on its own?

The one that wrote the sandbox, that didn’t work?

The one that wrote the user prompt?

The one that wrote the system prompt?

The one that provides the tools to the AI agent to do stuff?

The one that hosts the model?

The one that fine-tuned or post trained the model?

The one that pretrained the model?

The people that provided the input data to the model?

You seem to be missing my point. You are arguing against a point I did not make.

I’m not the owner of that laptop, I would just be a user. So with my argument I wouldn’t have a right install my own keys on it. I don’t need to trust that device. It isn’t mine. It is the one of my employer in that case the bank.

So I never said that the bank should trust my personal laptop with their data.

However, if I am a customer of that bank, and they give me access to my account data from my private laptop or smartphone. Then they have no right to enforce someone else to put their root of trust on my device. I need to be able to trust my device to protect my data, so the root of trust needs to come from me. If I don’t want to manage my device or if I don’t trust myself to do so, I should be able to transfer my trust temporarily to some other third party, and pay them to do it for me.

Imagine if you went to work at a bank in IT for example. They issue you a laptop.

Who is the owner of that device? The Bank.

Who is the owner of that network? The Bank.

So they are the arbiter of trust in that area. They are free to exclude non-bank-owned devices.

I work in IT, and I’m fine with getting a company laptop for company work. I don’t trust that laptop. I isolate it when I work at home. But the company trusts it, and that is fine.

You are not giving a reason for your statement. The owner is the one that bought a device. The sole arbiter about what a device should do or shouldn’t do. The person responsible of the device. The owner must trust their device in order for the device to be trusted. It doesn’t matter what if other people do or do not trust that device, they are not the owners. They should take care to protect their own data on their own devices.

I disagree. For any actual security, the owner of the secrets is the only one that can be trusted. It is their secrets. Their own interest to keep them save.

Any company or government is a shifting entity, maybe now they are trustworthy, but maybe in some years they aren’t.

Owners are the only stabile point, because it is their data. They should be able to transfer the trust to a company or government to handle security, but they also need to be able to take away that trust and access, and either handle it themselves or transfer that trust to some other entity.

It is not okay for companies or government to hold the data of individuals hostage… That is not security, that is a business strategy.

Also software… I would love to have regulations that make it clear that the root of trust on all devices need to start by the owner of the device, not by the vendor… That would allow the end users to repair the software on their devices… Replacing it with whatever else they want. Next would be to provide hardware documentation to the owners to program their own devices… I don’t expect that to happen, but I can dream.

Oh, just wait when all these AI companies ask for a government bailout… Free market in action…