You Ask, I Answer: Avoiding Generative AI, Part 2: Infrastructure

In today’s episode, you’ll learn about the crucial role of infrastructure and security in protecting your data from being used for AI training without your consent. You’ll discover the importance of hosting your website, email, and even social media on your own hardware or with trusted providers who prioritize data privacy. I’ll also dive into the importance of robust network security measures, including firewalls, VPNs, and tools like Lulu, to monitor and control data transmission. Tune in to gain practical strategies for securing your data and maintaining control over its use.

You Ask, I Answer: Avoiding Generative AI, Part 2: Infrastructure

Watch this video on YouTube.

Can’t see anything? Watch it on YouTube here.

Listen to the audio here:

Download the MP3 audio here.

Machine-Generated Transcript

What follows is an AI-generated transcript. The transcript may contain errors and is not a substitute for watching the video.

Christopher Penn: This is part two of how to avoid generative AI altogether. This is a five-part series. Today we’re going to talk about infrastructure and security.

Presumably, if you want to avoid generative AI entirely, you could just live in a cabin in the woods, off the grid and out of civilization. But that’s not realistic for a lot of people. So, what are the things that you can do as a business or as a person to reduce your exposure to generative AI?

When it comes to infrastructure, you’re going to need to provide it. Today, a lot of SaaS (Software as a Service) companies provide cloud-based options. You access them in a browser. Basically, you’re using somebody else’s computer. And when your date is on somebody else’s computer, they can—whether they’re permitted to or not—they can use your data with things like AI.

So, the precaution you have to take is, “How much of my infrastructure do I want to bring in-house to keep my data physically away from other people?” If you just don’t trust other people—and there’s good reason not to trust other people—you have to bring stuff in-house.

So what are those things?

Number one, your website. Who hosts it? What are the terms of service on it? How is it being protected?

You want to host your website on your own hardware, hardware that you control. You can host that at a co-location center, but that physical box is yours. No one else is allowed on it. It’s not managed. The co-location center has no access to it.

You want your website on your own hardware. You want your email services on your own server. You want a box somewhere that is running some form of Linux that is AI-free, running something like Postfix or another email service, so that you are providing your own email.

Because you can’t use—if you want to avoid generative AI—you can’t use Gmail, you can’t use Hotmail, you can’t use any of the web-based services. You’ve got to host and run your own email to keep that data out of other people’s hands.

If you want to use social media, you can’t use most social media. The terms of service—and again, we talked about that in yesterday’s episode—the terms of service on most cloud-based services allow them to use your data for AI.

One of the few social networks that does not is Mastodon, but you have to run the Mastodon node. You have to set it up, run it yourself, and protect it so that data does not leave your Mastodon node. Then you can invite your friends and colleagues to be on that node and say, “Hey, this is a no-AI node. Our data is not going to leave this node because we can’t trust where it’s going to go. You may not use data on this node for training AI.” You make that clear to your users. “You cannot use AI with this stuff.”

You will probably want to have a private cloud storage server somewhere as well: a physical server that has a big old hard disk that allows you to privately serve up your files. You can’t use something like Dropbox or another service like that because they all have the same terms of service that permit derivative works. As far as I know—I don’t think any of them carve out and say “we will not use data you store with us for training AI models.”

If that derivative works clause is in there—and again, remember, I’m not a lawyer, I can’t give legal advice—but if that derivative works clause is in there, it means that, legally, they can use your data for training AI.

So, private cloud storage: your server hosted in a data center somewhere that you maintain, that provides access to cloud storage.

On the networking side, you want robust protection. You want firewalls that block and knock away anybody that’s not supposed to be there—absolutely no ingress on your network. You want VPNs for you and your employees, again, to ensure that data transmission is secure in transit. Then nobody’s inspecting your data as it goes through their system. It’s tunneled through their systems.

There are some services that have double or triple tunneling, or tunneling with encryption. Whatever works best for you, and whatever you can afford, you’re going to want to do that.

You want tools—there’s a bunch of tools. There’s one for the Mac called Lulu, that allows you to inspect network traffic. When you turn this thing on, you have to essentially configure it app by app to say what that app is allowed to transmit. So if you have an app that’s supposedly local, that is not talking to the cloud somewhere, and you turn on Lulu, and Lulu says, “Hey, it looks like this app is trying to communicate out. Do you want to allow this?” you’d say, “Nope, not allowing it,” and prohibit that app from communicating with the outside world.

On your website, people say, “Block crawlers with robots.txt.” No, that does nothing. I mean, do it so that you have legal documentation— “Yeah, I put this in robots.txt to explicitly declare: AI crawlers not welcome here.” You want that in your content itself, saying, “AI crawlers not welcome here. You may not use my data to train AI.”

But if you really, really, really don’t want your data ending up in an AI model, it cannot be on the public web—at least not unprotected.

If you go on the dark web, there are plenty of websites where you have to enter a CAPTCHA just to get to the website. You can’t even see the website until you pass the passcode test at the front: “Drag the—tell you how many squares contain bicycles,” whatever. That is the only way to stop your data from ending up in AI models: to have none of it available publicly. Someone has to authenticate as human first.

A lot of websites have things like RSS feeds to make blog readers easier. An RSS feed is something that a crawler can find and extract data from, so you can’t have those. You can’t allow out RSS feeds.

Robots.txt does not stop a scraper that refuses to acknowledge it. If you write a scraper in a language like Python using Selenium or Requests or Scrapy, it’s an option as to whether it obeys robots.txt or not. You can say, “Nope,” and you write a scraper that just ignores that entirely. There’s no technical block to using that. That’s why you’ve got to put a wall around all your content and watermark the crap out of it—put a wall around your content so that scraper bots can’t get at it.

I know, for example, anytime that I publish a new blog post, I see versions of it on other websites. Some random Blogspot blogger is copying it because they’re scraping the RSS feed. It’s one of the reasons why I put so many ads in my RSS feed, so that people are scraping my ads and putting them all over the internet. But, if you don’t want that to happen, you can’t offer that. You’ve got to lock things down so that nothing is publicly visible. When any kind of scraper shows up, it immediately hits the CAPTCHA, and the CAPTCHA tells it, “See ya! Don’t let the door hit you where the good Lord split you!”

So that’s part two on infrastructure and security: the things you need to do from an infrastructure perspective if you want to prevent your data from ending up in generative AI models, or people using your data to train their AI models.

In the next section, we’re going to talk about some software and tools, so stay tuned for that.

If you enjoyed this video, please hit the like button. Subscribe to my channel if you haven’t already. And if you want to know when new videos are available, hit the bell button to be notified as soon as new content is live.

You Ask, I Answer: Avoiding Generative AI, Part 2: Infrastructure

Machine-Generated Transcript

Comments

Leave a Reply Cancel reply

Pin It on Pinterest