Top all-time · #4162
Tinfoil
Company blog · tinfoil.sh/blog · on HN as FrasiertheLionaisecurity
Tinfoil is the company blog at tinfoil.sh, writing about ai and security. Since 2025, 19 different Hacker News readers have linked it 39 times, most often “Tinfoil – Private AI”. It is still writing: the last post was on 2026-10-25, and you can follow it by feed.
Too few sampled comments (19) to say how often HN recommends it.?
Why HN links it
HN commenters link Tinfoil as a cloud AI service that runs open models inside attested secure enclaves, so users need not trust the provider. The linked blog posts compare its trust model with other providers.
Summarised by Claude from a sample of 19 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
AI that keeps your data private at all times. Fast, powerful, and verifiable, thanks to secure hardware enclaves.
Most-linked posts?
- Tinfoil – Private AI6 people · 7 mentions · first linked 2025-04-30
- /5 people · 10 mentions · first linked 2025-07-22
- Less Is More: From 1M Lines of Firmware to 300 of Assembly3 people · 5 mentions · first linked 2026-10-25
- End-to-end private LLM inference2 people · 3 mentions · first linked 2025-04-30
- Tinfoil private AI chat adds TEE-side content scanning2 people · 2 mentions · first linked 2026-10-02
- Tinfoil – Private AI Built on Secure Hardware2 people · 2 mentions · first linked 2026-08-27
- /blog/2025-01-30-how-do-we-compare2 people · 2 mentions · first linked 2025-05-15
What Hacker News says?
https://tinfoil.sh/ - ultimately there is no guarantee that the LLM provider isn’t spying on you, but at least tinfoil claims to be unable to do so.
Comment linking /
on “ChatGPT now knows what you do on other websites via ad collector”Submitted Running Private DeepSeek R1 with Verifiable Security as a story · 9 points
HN discussion> See the sibling comment, tinfoil added scanning inside the enclave. Clearly I'm not defending tinfoil regarding scanning but I think its only fair that you do not make the statement out of context[1]. People should read the context[1] and come to their own decisions. Also recall that given how attestation works, Tinfoil are forced to publish what they run in the enclave in their GitHub account[2] so you can verify…
Comment linking /blog/2026-09-14-safety-without-compromising-privacy
on “MiniMax M3.1 Flash”Submitted Less Is More: From 1M Lines of Firmware to 300 of Assembly as a story · 5 points
HN discussion> isn't that what ZDR is for? (assuming you trust that) ZDR is: 1. A pinky-promise you have no way of verifying 2. A contract term, which means its still subject to the good-old "lawful request or court order" clauses 3. Subject to arbitrary provider exceptions ... see Anthropic and Fable What you really want (assuming you can't afford your own servers and datacentre space) is secure enclave processing: See Tinfoil…
Comment linking /
on “MiniMax M3.1 Flash”Submitted End-to-end private LLM inference as a story · 3 points
HN discussionSorry but I wasn't talking about the Ars Technica article but the article that GP had shared that I had highligted under > The article that I am talking about which is generated by AI is this one: https://tinfoil.sh/blog/2026-10-25-less-is-more Hope this clears up the confusion!
Comment linking /blog/2026-10-25-less-is-more
on “Code-execution flaw in UEFI firmware threatens most servers on planet Earth”Submitted Tinfoil – Less Is More: From 1M Lines of Firmware to 300 of Assembly as a story · 2 points
HN discussion> https://tinfoil.sh/blog/2026-10-25-less-is-more The blog-post is written by AI. I am more than interested to hear a human talk about it but AI generated blog post removes that interest.
Comment linking /blog/2026-10-25-less-is-more
on “Code-execution flaw in UEFI firmware threatens most servers on planet Earth”Submitted Tinfoil private AI chat adds TEE-side content scanning as a story · 2 points
HN discussionWe recently wrote about moving away from OVMF (~1M lines of C) to very minimal and hyperspecific firmware (300 lines of assembly)[1] for our specific confidential VM machine targets, and the idea that "popular" does not automatically mean "secure". You can point an LLM at any large codebase and it will find vulnerabilities, so "patch the planet" isn't very scalable. You can instead just write hyperspecific, small co…
Comment linking /blog/2026-10-25-less-is-more
on “Code-execution flaw in UEFI firmware threatens most servers on planet Earth”Submitted Tinfoil – Private AI Built on Secure Hardware as a story · 2 points
HN discussionTinfoil's chat lets you do that, add a bit of context to every new chat. It's fully private, to boot, it's the service I use, these are Open Source models like DeepSeek, Llama and Mistral that they host. https://tinfoil.sh/
Comment linking /
on “So you think you've awoken ChatGPT”Submitted Tinfoil – Private AI as a story · 1 points
HN discussionThat's the best part, you don't. You only need to trust NVIDIA and AMD/Intel. Modulo difficult to mount physical attacks and side channels, which we wrote more about here: https://tinfoil.sh/blog/2025-05-15-side-channels
Comment linking /blog/2025-05-15-side-channels
on “Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI”Submitted Architecting Secure Prompt Caching as a story · 1 points
HN discussionLooks great. Not sure how big the market is between "need max privacy, need on-prem" and "don't care, just use what is cheap/popular" tho. Can you talk about how this relates to / is different / is differentiated from what Apple claimed to do during their last WWDC? They called it "private cloud compute". (To be clear, after 11 months, this is still "announced", with no implementation anywhere, as far as I can see.)…
Comment linking /blog/2025-01-30-how-do-we-compare
on “Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI”- 3s · 2026-05-01
Submitted Supply Chain Security – Part 1 as a story · 1 points
HN discussion Yes Azure has! They have very different trust assumptions though. We wrote about this here https://tinfoil.sh/blog/2025-01-30-how-do-we-compare
Comment linking /blog/2025-01-30-how-do-we-compare
on “Launch HN: Tinfoil (YC X25): Verifiable Privacy for Cloud AI”Submitted How an inference provider can prove they're not serving a quantized model as a story · 1 points
HN discussionYou sure? These links are directly from tinfoil.sh's technology page: https://tinfoil.sh/technology They use these technologies: - https://www.nvidia.com/en-us/data-center/solutions/confident... - https://www.amd.com/en/developer/sev.html - https://www.intel.com/content/www/us/en/products/details/pro... Specifically, the intel page says "Intel® Xeon® 6 processors with Performance‑cores support Intel® TDX Connect tec…
Comment linking /technology
on “I miss the old Claude Code”Submitted Confidential AI as a story · 1 points
HN discussionNot commenting on speed, but it seems models and their harnesses have generally gotten much worse over time. My suspicion is that the "Frontier" labs really dont have a strong handle on good quality evals that equal expectations of their users, so they just churn out new models for marketing to sell the shit out of. Recently cancelled my Codex subscription because I cannot stand 5.6-sol/terra/luna. On top of that, C…
Comment linking /
on “I miss the old Claude Code”A few startups [1,2] also offer infra for private AI based on confidential computing from Nvidia and Intel/AMD. 1. https://tinfoil.sh 2. https://www.privatemode.ai
Comment linking /
on “Building Private Processing for AI Tools on WhatsApp”Just use https://tinfoil.sh They solved all this stuff, I'm surprised more people aren't aware of it.
Comment linking /
on “Claude for Legal”Enclaves have a property that allows the hardware to compute a measurement (a cryptographic hash) of everything running inside it, such as the firmware, system software such as the operating system and drivers, the application code, the security configuration. This is signed by the hardware manufacturer (Intel/AMD + NVIDIA). Then, verification involves a three part approach. Disclaimer: I'm the cofounder of Tinfoil:…
Comment linking /
on “Intel Demos Chip to Compute with Encrypted Data”> I believe Nvidia chips have a secure way to run your model on other infra. Yes. And its already on offer today. See Tinfoil(US)[1] and Privatemode(Germany)[2] Tinfoil have not been independently audited, it is somewhere on their long-term radar. Privatemode have been thoroughly independently audited with documentation available on request. [1] https://tinfoil.sh/ [2] https://www.privatemode.ai/
Comment linking /
on “Austria Lobbies EU to Host Anthropic After US Access Curbs”- 3s · 2025-12-30
It uses confidential computing primitives like Intel TDX and NVIDIA CC, available on the latest generations of GPUs. Secure hardware like this is a building block to enable verifiably private computation without having to trust the operator. While Confer hasn’t released the technical details yet, you can see in the web inspector that they use TDX in the backend by examining the attestation logs. This is a similar ar…
Comment linking /
on “Confessions to a Data Lake” > zero data retention Zero data retention is also "trust me dude". There is no viable way of checking they are actually doing that. That's assuming they don't put carve-out clauses in, like Anthropic did with Fable, which means data retention is back on the cards, no exceptions. Also don't forget a zero data retention clause is still subject to the good old "law, or court or administrative order" contract clauses. :…
Comment linking /
on “Kimi K3 is now live”Another option is verifiably private inference with open source models running inside secure enclaves on the cloud (using NVIDIA confidential computing), and the enclave code is open source and verified via remote attestation upon connection, cryptographically proving that the inference provider cannot see any data. Tinfoil: https://tinfoil.sh/ is a good example of this (disclaimer: i'm the cofounder). You can read…
Comment linking /
on “Local AI needs to be the norm”
