Streaming ASR vs. Batch ASR: The Buffer-Latency Trade-off
Streaming and batch ASR pipelines compared: how input buffer length, speaker diarization, and where audio is processed trade latency against transcript quality and privacy.
Loading…
Topic
Privacy
122 posts about Privacy. Every summary links to the original.
- 122 posts
- 33 companies
- 2 explainers
See the idea
Privacy explainers
Hybrid Agent Runtime: Antigravity SDK's Local and Cloud Split
Antigravity SDK's hybrid architecture separates planning from execution: a cloud model plans, local models run most tokens on-device. See how routing, execution, and the data boundary fit together.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Supabase Beta August 2022
Supabase’s August 2022 Beta Update recaps Launch Week 5 releases, the Supa Hackathon, platform changes, migration resources, and community contributions. The release set includes Supabase CLI v1 with TypeScript type generation, the Management API Beta for programmatic project and organization control, and the supabase-js v2 release candidate with type support, new authentication methods, an async Auth overhaul, and Edge Functions improvements. Supabase also announced SOC2 compliance and made Realtime Presence and Broadcast available to all projects, alongside Vault, Auth UI, dashboard permissions, JSON schema validation, pg_graphql v0.4.0, and MFA early access. From September 11, HTTP API requests will redirect to HTTPS, and clients no longer need to send anon or service keys in the apiKey header; client-library users require no change.
Supabase Vault
Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, presented as a thin usability layer over pgsodium. The announcement contrasts it with pgcrypto, which accepts raw encryption keys directly and lacks public key signing, key derivation APIs, and streaming encryption. Vault stores secrets in an encrypted text column, while a unique per-database root key is managed outside SQL by pgsodium and libsodium; rows expose an internally derived key ID rather than the raw key. The vault.decrypted_secrets view decrypts values on demand, leaving stored data encrypted on disk and in backups, and users can create additional keys with pgsodium.create_key(). Vault uses Authenticated Encryption with Associated Data, binding the associated column to the authentication signature, and is positioned for API keys, access tokens, and environment variables rather than larger PII datasets.
Supabase is SOC2 compliant
Supabase reports achieving SOC2 Type 1 compliance and later updates the announcement to say it is SOC2 Type 2 compliant. The post explains SOC2’s five Trust Services Criteria and distinguishes Type 1’s point-in-time audit from Type 2’s observation period, while framing customer expectations and data stewardship as the main reasons for pursuing certification. Supabase used Vanta to monitor controls and collect evidence, selected an auditor familiar with SaaS companies and Vanta, and formalized practices covering device security, access control, policies, logging, monitoring, vendor reviews, and repository protection. The process still required substantial manual evidence, and the company found that audit scope and auditor expectations mattered more than achieving a perfect automated-tool score. Supabase also launched a security center and identified HIPAA certification as a next step.
Supabase Beta July 2022
Supabase published its July 2022 beta update alongside the announcement of Launch Week 5 scheduled for August 15-19. Key feature releases include a developer preview of Flutter SDK 1.0 with an emphasis on developer experience and Auth Helpers supporting server-side rendering environments like SvelteKit. The team introduced pg_jsonschema, an experimental 10-line Postgres extension created with pgx to enforce structure on json and jsonb columns. Security and identity features were expanded with an hCaptcha integration in authentication settings to block bot attacks. Additionally, email one-time passwords now accommodate lengths between 6 and 10 digits, while the GenerateLink method returns explicit verification metadata.
Data-Centric Machine Learning: Building Shopify Inbox’s Message Classification Model
Shopify Inbox needed to classify millions of monthly customer messages so merchants could prioritize responses and guide product decisions. The team adopted a data-centric approach, improving the dataset rather than primarily changing model architectures. An initial prototype used Universal Sentence Encoder embeddings, UMAP and HDBScan clustering, semi-supervised labeling, and a neural classifier, but reached about 70% accuracy with 35% high-confidence coverage. For version 2.0, the team created a more explicit taxonomy, used human-labeled data and fine-tuned DistilBERT, while addressing privacy and class imbalance through data handling and targeted annotation. In production, version 2.0 achieved about 90% accuracy and 80% high-confidence coverage, although the taxonomy and training data require ongoing updates as conversation trends change.
Partial data dumps using Postgres Row Level Security
Dumping full production databases onto local development machines creates severe security issues once applications hold real user data. To safely generate local seed data, developers can leverage PostgreSQL Row Level Security to restrict data access. The process involves provisioning a dedicated database user with select privileges on the target schema and tables. Next, administrators enable row-level security policies on those tables to filter records using criteria such as specific primary keys, email domain patterns, date intervals, or boolean flags. Finally, running pg_dump with the restricted user credentials and the --enable-row-security flag produces a sanitized seed.sql file containing only approved records.
Director of Machine Learning Insights [Part 3: Finance Edition]
Machine learning leaders in financial institutions face significant operational hurdles when integrating automated models into production environments. Practitioners must navigate complex legacy architectures, strict regulatory oversight, and privacy mandates tied to personally identifiable financial records. Integrating models often fails when organizations lack clear communication buffers, deploy models using improper prediction windows, or treat systems as opaque black boxes without verifying underlying mechanics. Despite these challenges, financial applications increasingly rely on machine learning for anti-money laundering compliance, automated fraud screening, and loan underwriting. Success in this regulated sector demands comprehensive evaluation across representative input spaces, robust ongoing model monitoring, and explainable decision outputs.
How facial recognition technology keeps you safe
Grab utilizes facial recognition technology across its platform for driver authentication, passenger verification, and digital electronic Know Your Customer (e-KYC) processes. The core pipeline consists of image preprocessing through face detection and alignment, anti-spoofing checks, feature extraction into high-dimensional vector embeddings, and downstream verification or search. To counter spoof attacks like screen replays, synthetic moiré patterns are generated and cropped face patches are used during training and inference to focus on local structures rather than global semantic noise. Face verification challenges involving shallow ID datasets and masked faces are resolved using semi-Siamese training architectures and masked data augmentations.
Our Favorite Moments From RailsConf 2022
RailsConf 2022 returned to an in-person format at Portland’s Oregon Convention Center after a two-year gap, with three days of keynotes, tutorials, and talks on technical and workplace topics. The 16th edition announced three new Rails Core team members, including Shopify’s Jean Boussier, and two new committers, while recurring themes included company investment in Rails, security, Active Records, “build vs buy,” diversity, and burnout. Shopify’s 15 Rails speakers contributed sessions and keynotes, and the recap gathers highlights on open-source staffing, long-term maintenance, developer wellbeing, Rails upgrades, supply-chain attacks, and modularization for “Big Rails.” Specific examples included regexp DOS risks, typosquatting and combosquatting, Rails upgrade automation, Ruby Archaeology, and the history of women in computer science. Because concurrent sessions and hallway conversations limited attendance, a virtual home edition and recordings were scheduled to make more talks available afterward.
Putting ethical principles at the core of the research lifecycle
Machine learning research risks introducing algorithmic biases, privacy violations, and malicious applications when ethical considerations are omitted from project lifecycles. To address these challenges, Hugging Face's multimodal learning group established an ethical charter at the inception of their multimodal project with input from ethics and governance experts. The charter defines content policies barring detrimental activities, the generation of personally identifiable information, and incautious applications in high-risk fields like medicine, law, and finance. Guiding values emphasize transparency, fairness through data and model bias reviews, self-critical curation, open reproducibility, and proper licensing attribution. Because ethical values like open data sharing and personal privacy can conflict, the team plans to iteratively evaluate trade-offs and track document revisions on GitHub.
Director of Machine Learning Insights
Directors of machine learning must balance complex mathematical modeling, system design, and sector-specific business operations across diverse industries. In digital media, practitioners leverage deep learning and Bayesian techniques to power assistive content creation tools and short-term interest recommendations while maintaining user privacy. Pharmaceutical teams employ natural language understanding, computer vision, and reinforcement learning across research and manufacturing, requiring strict GxP validation to navigate regulatory compliance and dataset diversity challenges. In the utility and energy sector, machine learning bridges disparate relational billing records, spatial GIS feeds, and physical grid machinery data to generate operational insights. Across these domains, leaders emphasize that successful integration depends on data quality validation, model monitoring safeguards, and assistive human-in-the-loop collaboration.
Machine Learning Experts - Margaret Mitchell
Machine learning models often internalize harmful dataset skews and fail to evaluate real-world contexts accurately. During work on vision-to-language generation, visual recognition systems learned to misinterpret destructive disasters as positive scenes because training images predominantly featured sunsets and fireworks. Addressing these structural flaws requires moving beyond benchmark optimization toward critical data analysis, dataset genealogies, and standardized ethical AI protocols. ML organizations must establish shared vocabularies for power differentials and dismantle competitive cultural norms that marginalize underrepresented contributors. Furthermore, lowering technical barriers—such as enabling non-engineers to inspect data without SQL—allows diverse stakeholders to evaluate models and prevent widening societal power divides.
Biometric authentication - Why do we need it?
Grab addressed the vulnerabilities and costs associated with SMS one-time passwords and PINs by implementing device-level biometric authentication. The architecture pairs device biometric sensors with hardware secure enclaves to protect private keys separately from the main operating system. During enrollment, Grab generates a public-private key pair using SHA512withECDSA, authenticates the user locally, and stores reference identifiers in encrypted device storage. HellfireSDK verifies that the device is not rooted, ensuring raw biometric data never leaves the handset. Early experimental runs indicate an adoption rate exceeding 90% and a login success rate near 90%.
Protecting Personal Data in Grab's Imagery
Grab's KartaView platform collects geotagged street imagery across over 100 countries, requiring automated obfuscation of faces and licence plates to protect personal privacy. Because off-the-shelf solutions struggled with diverse global environments and equirectangular 360-degree camera formats, Grab built a custom machine learning pipeline. The system projects varied image formats into standardized planar views, applies a YOLOv4 object detection model to locate target regions, and transforms bounding coordinates back to the original imagery for blurring. Training the detector required iterative dataset updates to accommodate edge cases like face masks and mirror reflections, paired with offline view splitting and oversampling of scarce large bounding boxes. Assessments confirmed that obfuscating these regions had minimal negative impact on downstream map feature extraction services.
Shopify-Made Patterns in Our Rails Apps
Shopify describes patterns and infrastructure adaptations used to keep its large Rails monolith maintainable as its organization and platform scale. Its dev command-line tool standardizes project setup, dependencies, services, environment variables, integrations, and command aliases across hundreds of active projects. Shopify Core uses pods to partition shops across independent databases and extends the shard concept across provisioning, deployment, load balancers, caching, and servers, while splitting code into domains without separate databases. The post also details safeguards including short-term Active Record migrations consolidated periodically into structure.sql, automated tests, a pod-aware maintenance task system, and a translation platform that commits translated strings through Git. Finally, Monorail imposes versioned JSON event schemas between Kafka producers and consumers and supports review and automated scrubbing of PII fields.
Deleting the Undeletable: Managing PII at Shopify - Shopify
Shopify describes how its Privacy and Data Science & Engineering teams redesigned analytical event handling to make personal-information deletion workable at Shopify’s scale. The effort addressed a lack of guaranteed event schemas by introducing a human-readable JSON schematization system covering field types, version evolution, ownership, data controllers and subjects, and privacy instructions; more than 4,500 active schemas now govern events. Before warehouse storage, identifying data is either obfuscated into generalized values, such as masked IP addresses with city or country information, or tokenized into consistent random values whose mappings reside in a secured vault and vary by controller and subject. Removing a vault mapping makes warehouse copies of the token non-detokenizable, allowing deletion without warehouse operations; the production platform processes about 20 billion events daily, while tens to hundreds of millions of mappings are deleted daily.
Few-shot learning in practice: GPT-Neo and the 🤗 Accelerated Inference API
Limited labeled data often prevents machine learning models from achieving high performance during traditional fine-tuning. Few-shot learning addresses this hurdle in natural language processing by supplying a short task description and a few demonstration examples at inference time. EleutherAI developed GPT-Neo, an open transformer-based model trained on the Pile dataset, which can execute few-shot tasks via the Hugging Face Accelerated Inference API. Compared to larger models like GPT-3, the 2.7B parameter version of GPT-Neo requires three to four examples alongside tuned hyperparameters like temperature and stopping sequences to generate accurate completions. Because few-shot learning relies heavily on pre-trained associations, careful output monitoring and human feedback mechanisms remain necessary to prevent automated bias.
Health matters: Store and process healthcare data in a HIPAA-compliant manner using Intercom
Intercom announces that it has completed a HIPAA attestation examination covering how it stores and processes health-related data, including protected health information (PHI) and electronic protected health information (ePHI). The examination was performed by an independent Certified Public Accounting firm, which reviewed HIPAA policies, procedures, and controls against the HIPAA Security Rule and HITECH Breach Notification Rule requirements. Intercom says the result allows it to enter Business Associate Agreements with applicable healthcare customers and make the attestation report available for review. Reported customer metrics include a 90% median CSAT score, 36% automatic resolution of common healthcare questions, and more than 500k healthcare conversations powered daily. Intercom also says it will perform the examination annually, alongside its stated ISO:27001 certification, SOC 2 Type 2 compliance, GDPR and CCPA compliance.
Grab-Posisi - Southeast Asia’s First Comprehensive GPS Trajectory Dataset
Grab released Grab-Posisi, a GPS trajectory dataset covering Singapore and Jakarta designed to overcome the poor coverage, low sampling rates, and missing contextual metadata common in existing public datasets. Captured in April 2019 from drivers in transit, the dataset comprises 84,000 trajectories, over 80 million GPS pings, and more than 1 million kilometres recorded at a one-second sampling frequency. Each entry in the 2 GB Apache Parquet dataset records geographic coordinates, timestamp, accuracy radius, bearing, speed, mobile operating system, and vehicle mode. To protect privacy, driver personal information is encrypted and trip start and end locations are removed. The data enables applications including automated road network reconstruction, map matching, real-time traffic forecasting, and municipal infrastructure planning.
Chrome’s Changes Could Break Your App: Prepare for SameSite Cookie Updates
Chrome's SameSite changes alter when third-party cookies are sent in cross-site requests, affecting sites that rely on embedded services, analytics, advertising, or other cross-domain functionality. Starting February 4, 2020, Chrome was to reject such cookies unless they were secured and assigned an appropriate SameSite value, as part of a secure-by-default model intended to reduce CSRF attacks, other vulnerabilities, and privacy leaks. The post explains first- versus third-party cookies, contrasts Strict, Lax, and None, and gives scenarios for selecting each setting; SameSite=None must be paired with Secure and HTTPS. It also recommends enabling Chrome 80 flags to test for errors, then updating application cookies or coordinating with third-party providers. Server-side support is noted for PHP, NodeJS, Python, Flask, and Ruby on Rails, with direct JavaScript cookie handling also mentioned.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.