Hacker Newsnew | past | comments | ask | show | jobs | submit | dsiroker's commentslogin

(Co-founder & CEO of Limitless) Thanks for trying it and I hope to win you back with the new features we have in the works!

As for selling data if consumers don’t want to pay for it: I commit publicly to never doing this. I will shutdown the company and return remaining capital to investors if consumers don’t want to pay for what we are building. So far, so good, and we were actually cash flow positive a few of the last few weeks.


Congrats!

I actually like your Limitless meeting transcription tool and have a subscription for that reason.

I wish your focus was on the software but rather than the hardware.

#1 request is simply the ability to export my data so that I can more easily load it into other tools to ask questions against.

You have a treasure trove of all of my meeting transcripts for the past year but I’m really nervous they will be lost forever at some point.


(Co-founder of Optimizely here) Congrats! It was fun competing with you


Dan, thank you! I has been fun competing with you.

I remember the golden days :)

I've been following your journey post Optimizely! Hope your new ventures turn out to be equally fun and fulfilling.


I think it was a time when bootstrapping was a thing.. I feel its scary for new startups to bootstrap since the last decade with huge fundings, especially with funding in billions becoming a normal with the ongoing AI craze.

https://news.crunchbase.com/ai/largest-ai-startup-funding-de...


I think that's more skewed towards the AI startups. Other startups have rather seen a dip in recent times, at least in India.


AI inference is expensive, hence, funding is needed. In future, when AI infra becomes cheaper, we will see more bootstrapped AI startups too.


Congrats to you both!! Paras- you guys were always one of the ones we looked up to when starting Amplitude way back in 2012.


Thanks Spencer! You've built an amazing product, we're hugely inspired by Amplitude.


Optimizely as in Episerver?? I thought Optimizely was Episerver's rebrand.


Episerver bought Optimizely and then took the name.


Oh what a strange decision. But that makes more sense than yhe reverse.


Why "was"?


Optimizely also sold to private equity many years ago. Presumably the founderts aren't there any more.


Love your enthusiasm! Our plan is to subsume Rewind functionality into Limitless. Sorry it has taken longer than I wanted. The pendant has taken a lot of our time and focus.


I'd love that, but most of all I'd prefer to host things on my own servers.

Also I'd buy a pendant if I can send it to my own S3!!!!


That's why we are going to offer Consent Mode.

Consent Mode makes it possible for the first time ever to only capture the voice of people who have given consent to be recorded.

It uses voice identification to determine who is speaking and verbal opt-in to make it frictionless to ask for consent.

Here's a direct link to the timestamp of the announcement where we show how Consent Mode works: https://twitter.com/dsiroker/status/1779857843895599383?t=26...


I've previously worked on the Google Assistant from several angles, and this demo'd awesome, and I was very surprised. Then I saw it is listed as "soon" on the roadmap. Then I remembered the demo was very much a video, not a demo.

I might be jaded from years of bigco, and I'm rooting for you, hopefully you're already set enough financially you can ignore this, innovate, and already have teams of people demo'ing a solution internally:

As a company, you can't get trust back. Fudging a bit and projecting what you'll have when you ship is very tempting when the competition is this thick. Having this much competition also implies there will be choice, and given the use case, it's likely people will always opt for choices that appear more trustworthy.

On a completely separate note, I've seen many, many, teams of extremely bright people be funded for 2-4 years on things that you'd think "it can't be that hard..." and it turns out it's impossible. Not this specifically, but voice adjacent stuff.

Again, rooting for you, but a forthright version of me would have just said it'll never work as demo'd, and it's worth considering what impact it'll have long-term on your success if even just 20% of whats on the roadmap doesn't work out, you're already talking about it in present tense, and it's absolutely key to your user trust story. 20% is conservative in my experience.


I'm sure you've considered how the BIPA law in Illinois applies since it's one of (if not the) strongest biometrics privacy laws in the U.S. Could you share some detail on how you store and process unknown voices before consent?

For context, this is BIPA: https://law.justia.com/codes/illinois/chapter-740/act-740-il... and it's why Facebook, Google, and others have sent fairly large settlement checks to Illinois residents over the last few years.


You're wording in this comment (and the twitter/comment video) gives off the same vibes as the google april 1st videos for things like gmail motion (https://www.youtube.com/playlist?list=PLAD8wFTLnQKeDsINWn8Wj...). I honestly thought this was full sarcasm at first.


Just a tip - consent shouldn't be a mode, it should be the default. Might want to re-think how you market the idea because done correctly, it is a powerful feature.


So you record people without consent and pinky swear that your software will “unrecord” after the fact? I don’t know if you can just hand wave that away… ship has probably sailed on anyone enforcing these kinds of laws I guess, good luck


Yeah, that seems like exactly the sort of shenanigans that would get certain kinds of judges extremely unhappy.


It's likely more nuanced than that.

I'm reminded of how I felt it was unfair that the hotword detector for assistants was discussed as "recording", but it's really just parsing a byte stream, never storing it.

Voice ID systems I'm familiar with work on a similar premise.


Why is Consent Mode OFF by default?

https://xoxo.zone/@andybaio/112276682288723340


Why is it possible for it to be off at all?


Hella sus


Confidential Cloud is similar to end-to-end encryption, but with the added benefit of letting your personalized AI work for you even when you aren’t using the app.

You control who can decrypt your data

Your employer, we as software providers, and the government cannot decrypt your data without your permission, even with a subpoena to do so.

Your data is anonymized

There is an initial mapping from your application request to an anonymous ID, but after that, even we don't know whose encrypted data is whose.

Your data will never be sold

Not only do we pledge never to sell your data, but we couldn't even if we wanted to because we can't decrypt it without your permission.

Envelope encryption with unique secret keys

Data keys are used to encrypt your data and are themselves encrypted under a secret key. No one, including us, can export the secret keys.

Tamperproof hardware

Decrypted data is only ever stored in memory (source: <https://docs.aws.amazon.com/kms/latest/cryptographic-details...>), which is protected from tampering by a multi-chip standalone hardware cryptographic appliance (source: <https://csrc.nist.gov/projects/cryptographic-module-validati...>).

Protected from 3rd party AI providers

Data sent to 3rd party AI providers for transcription and summarization is anonymized, not used for training, and deleted after 30 days.

Protected from cloud provider and subpoena

AWS KMS (source: <https://aws.amazon.com/kms/>) uses FIPS 140-2 (source: <https://csrc.nist.gov/CSRC/media/projects/cryptographic-modu...>) validated hardware security modules (HSMs) to ensure no one, including AWS employees, can retrieve your plaintext KMS keys.


Limitless is encrypting at rest, not using end-to-end encryption.

E2EE suggests that only the user (or at least only people the user knows about in the case of e.g. group chats) is able to see/access the decrypted data, which is false. Limitless does not decrypt data on the client using a key only the user has access to, it decrypts the data on the server (in this case using AWS KMS) and sends it to the client. Even if we remove just decrypting everyone’s data out of the equation using AWS KMS (since the user does not control the key), you could trivially write a Cloudflare Worker (since you use Cloudflare on your API subdomain) that simply sends the (unencrypted) API response along with the email from the Supabase JWT used in the header to a server that accumulates everyone’s recording names, transcripts, generated notes and generated summaries. If someone gained access to your Cloudflare account they could also do this. You’re advertising Limitless as if you aren’t able to see people’s transcripts even if you wanted to, which is false. Even your employer can if they TLS MitM you with their own TLS certificates, which is not rare. On the other hand, Signal cannot see your data unless they modify client code, nor can your employer unless they install a modified Signal client on your device or install spyware on your device, which is reading decrypted data from memory. This is what separates encrypting at rest and E2EE (which you say your solution is just as secure as and is better than) for the end user and it feels like false advertising. Limitless, your employer and a potential hacker can all read your data, at the minimum while you’re using Limitless.


There is no way to anonymize transcripts where I and others refer to me by name and reference uniquely identifiable information. What happens when the AI provider is served with a warrant or subpoena for transcripts mentioning MacsHeadroom in the 30 day window?

Your "anonymization" does nothing. You have major egg on your face right now.

The only remotely anonymous version of a service like this involves a private LLM endpoint.

I have Mixtral 8x22B and CommandR+ running on my home LLM sever. How can I use Limitless without handing my "anonymized" (but NOT actually anonymized in any way shape or form) PII over to a third party who retains it for at least 30 days (or longer if someone with a badge or gavel asks)?


This is nonsense. If you can send the data over to third party AI providers for transcription and summarization, you can just as well send it to anyone else who asks for it (e.g. government wiretap, advertisers) whilst removing the "anonymization" part. It doesn't matter that you cannot export the keys used to decrypt in-memory if you control the code that then processes the decrypted data.

It is not at all "similar to end-to-end encryption".


Sorry, but what? How do you do any of the AI training or inference without decrypting the data in the cloud? I seriously doubt it's all running locally on the pendant.


We wouldn’t be where we are today without our existing customers, so all Rewind Pro subscribers get Limitless Pro for free.

We are shifting our focus to Limitless because we think it’s a better approach to solving the same problems. In fact, we plan to implement many of your favorite Rewind features directly in Limitless.

We are so bullish on Limitless that we decided to change our company name from Rewind to Limitless.

That said, we have no plans to stop supporting Rewind.

You can even use both products side-by-side and decide for yourself which one you like better.


So Rewind will be the local version and Limitless will be the cloud version? Will Rewind still be coming to windows?


(I'm the co-founder & CEO of Limitless)

We are so honored this hit the front page of HN!

Here's the video announcement: https://twitter.com/dsiroker/status/1779857843895599383

And timestamps to moments in the video you might be interested in:

0:06 Reveal

0:48 Why Limitless?

1:39 Demo

3:05 Pendant

4:27 Privacy

5:23 Confidential Cloud

6:36 Rewind

7:12 Roadmap

9:25 Vision


What is the purpose of an additional device with a microphone? Presumably all of your users already own a smartphone, which already has a microphone.

If Limitless gets PMF, anyone who puts Whisper into an iPhone app will do what you’re doing basically for free.


Hardware is hard. We would have happily done this as a native iPhone or Watch app if it were possible. We explored that first. But, unfortunately both iOS and watchOS don't support it. In particular, anytime you listen to audio (a YouTube video, phone call, etc) it turns off the microphone and you have to remember to turn it back on.


I pre-ordered the rewind, and noticed that I'll be upgraded for free! But my question is for the subscription, will there be any discounts for the pro plan?

Also, I do notice that the free version has 10 free hours a month of AI features.

How easy would it be for me to export the recordings, and use it with say Google Gemini Pro for transcribing?


Do you plan to add support for microsoft calendars and email? I have gmail but none of my work stuff is in there so I can't really make great use of this :(


I hate how people keep pretending that only Google does calendar and mail. These things have been standardized for decades for a reason.


What's the summary for vision? Is there going to be a device?


(co-founder & CEO of Rewind here)

I'd really love to share more but our competitors will try to imitate it and I want to build as large of a lead as I can before we unveil it.

I'll just say: it is fundamental to the product experience, not a bolt on.


>> We offer features for you to ensure no one is recorded without their consent.

> it is fundamental to the product experience

Without speaking too much to the underlying implementation, could you at least:

Clarify if "fundamental to the product experience" and "ensure no one is recorded without their consent" means the control loop is able to sense a non-consenting speaker and stop recording?

Clarify if "recorded without their consent" means never sending recordings off-device? Or does it just mean omitting the record from user facing long-term storage?

Clarify whether consent is opt-in or opt-out?

Clarify whether consent is actually consent, or the effective equivalent of supplying the user a "resume recording" button?


FWIW, I’m an existing customer (of the app) and this has significantly damaged my perception of Rewind as a company. You should stop talking about it until you have a credible answer to this question.


Thanks for the feedback! Do you think this qualifies as a credible answer? If not, what more can we offer to rebuild your trust in us?

https://twitter.com/dsiroker/status/1709605449253974352


Hello,

Do you sell it to Portugal?

Thanks in avance.

Hugo


(Rewind CEO here) I’ve been at this for a while: https://x.com/dsiroker/status/1708997628506292255


you have, so can you share why your privacy advertising doesn't align with your use of openai? you aren't running local llms, you even at one point tried to use openai's marketing term to get some more hype (ChatGPT for me), so why hype up the AI side while also advertising privacy when the two don't work together?


It’s been 14 years since my first submission to HN and I am so grateful to this community for all your feedback & help on my first company (Optimizely) and now my second one (Rewind). Today we’re introducing Rewind for iPhone - a truly personalized AI in your pocket. I’d love your feedback!

Browse & search for any word you’ve seen (including screenshots)

- Rewind automatically captures what you read in Safari and imports your screenshots.

- You can preserve & search for anything you’ve seen on your iPhone.

- This opens a new dimension of computing: time.

Summarize and ask any question using AI

- Rewind integrates with OpenAI GPT-4 to allow you to ask any question about anything you’ve seen.

- Create summaries, synthesize information across apps, or remind yourself how you know someone.

Private by design

- Private browsing in Safari is not captured.

- Using GPT-4 is optional and only the relevant text necessary to answer your question is used.

- Your data is not used to train AI models.

- All recordings are stored locally and only you have access to them.

Learn more: https://www.rewind.ai

Please let me know what you think!


What data leaves my iPhone?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: