8 ms·

Ah yes, the "slippery slope" argument, where evidence is never required, pessimism always wins over realism, and any counter-argument can be dismissed with "but

Ah yes, the "slippery slope" argument, where evidence is never required, pessimism always wins over realism, and any counter-argument can be dismissed with "but they COULD!"

RIMR 5y ago
I think we've learned from experience that tech companies will happily exploit anything they’re capable of exploiting, and this new capability has plenty of potential for exploitation. Searching everyone's media for evidence of criminal wrongdoing, but setting only one example of the kind of wrongdoing you're looking for is very susceptible to an actual slippery slope, given that there are plenty of other criminal activities they could start looking for should they decide that it's part of their mission. The only thing that makes CSAM so attractive to go after is how disgusting society feels that it is. Up next could be reporting drug-related texts of known convicts to parole officers. Next could be drug-related texts of everyone to police officers. Next could be letting the police officers make their own searches, where they find everyone talking about a certain kind of political organizing. We should refuse to accept even the first instance of this kind of thing.
rsgrn 5y ago
You're right in one sense. In another, isn't this exactly what people said about intelligence agencies ("they could but they don't") and then... Snowden.
- acer4666 5y ago
  What about Snowden? He's an irrelevant hack whose only goal is to make himself famous.
  - rsgrn 5y ago
    That he demonstrated that those agencies were actually doing the things people said they would do, while being defended by people who used arguments quite like gp comment. I used the word "Snowden" not to refer to him, but to the event. Why? Because I didn't want to type the three letter keyword into my comment. Which is an example of the chilling effect these activities cause.
    - etchalon 5y ago
      You're really scared of typing NSA?
Hamuko 5y ago
Considering that Chinese iPhone users already do not enjoy the same privacy features as non-Chinese iPhone users, I would not be at all surprised if Chinese iPhones are going to have a lot more "child porn" hashes to check against.
- etchalon 5y ago
  All data in China is already stored on servers that the CCCP has access to. Why would they need to invoke a convoluted hash match scheme when they can just perform broad checks on the data they can access?
  - skinkestek 5y ago
    Yep. Good point. But this will further open possibilities for abuse not only in China but everywhere else as well.
Syonyk 5y ago
Do you trust your government to not abuse "But they could?" types of capabilities? I don't. I've seen what the FBI claims, that they then magically find ways around the "impenetrable encryption" they claim they can't break (but then do), and I don't trust them to not require Apple to add hashes of "things they find problematic," and include a gag order with it so Apple can't report it. I've worked computer security long enough to know that it's always worse than advertised, always will be abused, etc.
- etchalon 5y ago
  If you've worked in computer security long enough, you know that Apple could already have added a backdoor into every build of iOS that allows the government to read any material on your device they chose to read. My contention isn't that I trust my government, but instead that this specific technology is no more threatening than the technology already present on my phone and the trust I've already placed in the vendor.
  - Syonyk 5y ago
    > If you've worked in computer security long enough, you know that Apple could already have added a backdoor into every build of iOS that allows the government to read any material on your device they chose to read. Yes. They could. However, getting caught doing that, from Apple, would be an absolute disaster for them, and they've both made the right statements and made the right actions in terms of things like physical device security (moving more and more into the secure enclave to protect against demonstrated attacks). It's entirely possible they've done this for specific cases, with a gag order, and nobody knows. However, it cannot be widespread, or it would end up known. This, however, is adding a blackbox image matching algorithm (we know it's not matching image file data based on statements about how it's robust against cropping/rotation/resizing/etc), and a blackbox database of "Stuff claimed to be Really Bad." There is no way to audit the database and see what's in it, because of the one way nature of hash functions, and there's almost certainly not a pile of the source material laying around for audit reasons (because that would be a really nasty legal problem). So you've got a "Trust us, this stuff is bad" database, and a "Trust us, it matches images accurately" hash function. And, if those find enough matches (also unspecified), you get yourself reported directly to the various authorities. It's guilt by algorithm, across every single Apple device (running the latest OS, etc... handwave as needed). That's very, very different from a customized backdoor deployed to a small number of phones.
gouggoug 5y ago
It is a slippery slope argument, but wouldn't you agree that it's been proven by the past decade of events (e.g. Snowden) that we can expect governments to try (and succeed) to abuse originally well intentioned technologies to spy on anyone?
colordrops 5y ago
The "slippery slope" argument is not a fallacy. If you were in 2001 and told people what the state of data collection and privacy would look like in 20 years, they'd call you an absolute conspiracy nutjob. It was a national news story then that a printer driver phoned home. Now look at where we are at, and every loss of privacy has had some seemingly reasonable excuse.
- etchalon 5y ago
  It's absolutely a fallacy according to any course on logic because it is impossible to refute. https://www.txstate.edu/philosophy/resources/fallacy-definitions/Slippery-Slope.html https://www.txstate.edu/philosophy/resources/fallacy-definit...
  - colordrops 5y ago
    For the narrow formal definition in your link, that being an assertion without evidence, then yes, it's a fallacy. In the colloquial language we are using here, there is absolutely evidence, tons of it, that this will take the same downward trend of previous infractions.
    - etchalon 5y ago
      Are you under the impression that people who teach logic are unaware of real world evidence that "things change and some of the those end up being bad"?
      - colordrops 5y ago
        No, I am under the impression that in this thread we are using the term "slippery slope" to mean something else that the one you provided in the link. Also your characterization of "things change and some of the those end up being bad" is not the nature nor specificity of the evidence in this case. Lastly, perhaps you should remain consistent and not utilize the "appeal to authority" fallacy.
revolvingocelot 5y ago
I remember when they put a fucking U2 album on everyone's phone. Remember that? Many found that suspicious, but I recall people like you saying "oh Apple can write, who cares, but they'd never read, you're being ridiculous". I remember when an Apple auth server went down and no one could launch non-Apple applications because Apple needed to see the hashes of the things people ran on their computers.[0] When will the slope be inclined enough for you?! [0] https://mobile.twitter.com/llanga/status/1326989724704268289 https://mobile.twitter.com/llanga/status/1326989724704268289
- aaomidi 5y ago
  The OCSP example is stupid and people should stop using it. Apple was following an RFC written specifically because PKI sucks.
  - revolvingocelot 5y ago
    I'm sure I'll be revealing my ignorance here, but what does revoking certs have to do with Apple needing to know who's running youtube-dl or tor or anything else? Was the revocation of something somehow contingent on the specific application being run, or vice versa?
    - aaomidi 5y ago
      Apple requires signing of code that's going to run on MacOS. You can disable this, but it is a nice little security feature that allows Apple to quickly react if a virus starts spreading on their devices. They revoke that certificate and OCSP (which is a standard way of checking for revocation) blocks that software from running. Apple's design was fail closed, so if OCSP is down, assume the application has had its key revoked. Unfortunately that's just how OCSP is, your browser (if you're using Firefox) does this with CAs. The unfortunate thing is, due to the nature of desktop applications, OCSP stapling doesn't really work when you're not the one serving content.
      - revolvingocelot 5y ago
hncurious 5y ago
You're right, but isn't the rapid expansion of censorship and surveillance the past year evidence that we are currently slipping down the slope?
spockz 5y ago
Just the other day in the Netherlands it came out that cameras placed with the strictest promise that they would only record license plates and only trigger when it matched with a known license plate now also capture persons in the car. And before that the systems were changed to store pictures for 28 days in order to look back. It also came out that the deletion doesn’t always work and that the obfuscation that is supposed to happen also doesn’t always happen. The reaction of the police seems to be “why do you care about this? We have the data let’s use it. And we could use it to find those ~killers~ these people that allegedly just killed the most popular crime news reporter. So let us do our work.” Just like software expands to eat cpu/memory/disk resources and people start living up to their salaries: whatever is possible will happen. To me the slippery slope argument is perfectly valid.
- etchalon 5y ago
  I look forward to the day that marrying your hamster is legal.
longtom 5y ago
Edward Snowden's revelations provide very solid evidence that what can be done is being done.
Zak 5y ago
Prior to this change, they couldn't. Now they could. It's much easier to change the policy than to add a new mechanism. Governments, including the US government have previously attempted to force Apple to break into users' devices, and often apply gag orders to such attempts. Now they could, and that's enough for me to be unwilling to keep sensitive information on an iOS device.
- etchalon 5y ago
  You do not seem to understand what was actually implemented.
  - Copernicron 5y ago
    In what way does the OP not understand what was implemented? This gives apple the ability to monitor any file on your device. Not only that, but all we have is the government's pinky promise that the database contains only CSAM. There is no verification. How do we know that it isn't going to end up filled with gay pornography involving consenting adults when the "feature" is rolled out in Saudi Arabia?
    - etchalon 5y ago
      How do you know that the image classifier on your iPhone, that exists today, and detects faces, isn't also detecting whether the photo has a gun in it?
      - skinkestek 5y ago
        We don't know, but a photo of a gun isn't going to break your marriage, make you lose your job, make your friends hate you and get you thrown into jail for weeks. Someone finding a way to plant this kind of material on your phone does that. Besides, the fact that something that can be misused exist isn't a very good defense for creating something else that widens the opportunity for abuse significantly.
  - Zak 5y ago
wyager 5y ago
Slippery slope is a shockingly predictive heuristic.
- etchalon 5y ago
  It very, very rarely is.
  - skinkestek 5y ago
    If anything, the last decade has been a huge slippery slope. If you haven't noticed jokes is on you.
hapless 5y ago
Well, there's not really any slope here. Apple plans to have a target database of BAD FILES!!1! that will get your name handed to the government. It's not subtle. No expansion to the program is necessary to violate your privacy or endanger dissidents.
randyrand 5y ago
Slippery slope? What they already announced is abhorrent. Scanning all of our photos against our wishes? Who cares what it's for? The fact that they are even doing this at all is a huge infringement to their customer's autonomy.

Ah yes, the "slippery slope" argument, where evidence is never required, pessimism always wins over realism, and any counter-argument can be dismissed with "but they COULD!"

RIMR 5y ago

I think we've learned from experience that tech companies will happily exploit anything they’re capable of exploiting, and this new capability has plenty of potential for exploitation. Searching everyone's media for evidence of criminal wrongdoing, but setting only one example of the kind of wrongdoing you're looking for is very susceptible to an actual slippery slope, given that there are plenty of other criminal activities they could start looking for should they decide that it's part of their mission. The only thing that makes CSAM so attractive to go after is how disgusting society feels that it is. Up next could be reporting drug-related texts of known convicts to parole officers. Next could be drug-related texts of everyone to police officers. Next could be letting the police officers make their own searches, where they find everyone talking about a certain kind of political organizing. We should refuse to accept even the first instance of this kind of thing.

rsgrn 5y ago

You're right in one sense. In another, isn't this exactly what people said about intelligence agencies ("they could but they don't") and then... Snowden.

acer4666 5y ago
What about Snowden? He's an irrelevant hack whose only goal is to make himself famous.
- rsgrn 5y ago
  That he demonstrated that those agencies were actually doing the things people said they would do, while being defended by people who used arguments quite like gp comment. I used the word "Snowden" not to refer to him, but to the event. Why? Because I didn't want to type the three letter keyword into my comment. Which is an example of the chilling effect these activities cause.
  - etchalon 5y ago
    You're really scared of typing NSA?

Hamuko 5y ago

Considering that Chinese iPhone users already do not enjoy the same privacy features as non-Chinese iPhone users, I would not be at all surprised if Chinese iPhones are going to have a lot more "child porn" hashes to check against.

etchalon 5y ago
All data in China is already stored on servers that the CCCP has access to. Why would they need to invoke a convoluted hash match scheme when they can just perform broad checks on the data they can access?
- skinkestek 5y ago
  Yep. Good point. But this will further open possibilities for abuse not only in China but everywhere else as well.

Syonyk 5y ago

Do you trust your government to not abuse "But they could?" types of capabilities? I don't. I've seen what the FBI claims, that they then magically find ways around the "impenetrable encryption" they claim they can't break (but then do), and I don't trust them to not require Apple to add hashes of "things they find problematic," and include a gag order with it so Apple can't report it. I've worked computer security long enough to know that it's always worse than advertised, always will be abused, etc.

etchalon 5y ago
If you've worked in computer security long enough, you know that Apple could already have added a backdoor into every build of iOS that allows the government to read any material on your device they chose to read. My contention isn't that I trust my government, but instead that this specific technology is no more threatening than the technology already present on my phone and the trust I've already placed in the vendor.
- Syonyk 5y ago
  > If you've worked in computer security long enough, you know that Apple could already have added a backdoor into every build of iOS that allows the government to read any material on your device they chose to read. Yes. They could. However, getting caught doing that, from Apple, would be an absolute disaster for them, and they've both made the right statements and made the right actions in terms of things like physical device security (moving more and more into the secure enclave to protect against demonstrated attacks). It's entirely possible they've done this for specific cases, with a gag order, and nobody knows. However, it cannot be widespread, or it would end up known. This, however, is adding a blackbox image matching algorithm (we know it's not matching image file data based on statements about how it's robust against cropping/rotation/resizing/etc), and a blackbox database of "Stuff claimed to be Really Bad." There is no way to audit the database and see what's in it, because of the one way nature of hash functions, and there's almost certainly not a pile of the source material laying around for audit reasons (because that would be a really nasty legal problem). So you've got a "Trust us, this stuff is bad" database, and a "Trust us, it matches images accurately" hash function. And, if those find enough matches (also unspecified), you get yourself reported directly to the various authorities. It's guilt by algorithm, across every single Apple device (running the latest OS, etc... handwave as needed). That's very, very different from a customized backdoor deployed to a small number of phones.

gouggoug 5y ago

It is a slippery slope argument, but wouldn't you agree that it's been proven by the past decade of events (e.g. Snowden) that we can expect governments to try (and succeed) to abuse originally well intentioned technologies to spy on anyone?

colordrops 5y ago

The "slippery slope" argument is not a fallacy. If you were in 2001 and told people what the state of data collection and privacy would look like in 20 years, they'd call you an absolute conspiracy nutjob. It was a national news story then that a printer driver phoned home. Now look at where we are at, and every loss of privacy has had some seemingly reasonable excuse.

etchalon 5y ago
It's absolutely a fallacy according to any course on logic because it is impossible to refute. https://www.txstate.edu/philosophy/resources/fallacy-definitions/Slippery-Slope.html https://www.txstate.edu/philosophy/resources/fallacy-definit...
- colordrops 5y ago
  For the narrow formal definition in your link, that being an assertion without evidence, then yes, it's a fallacy. In the colloquial language we are using here, there is absolutely evidence, tons of it, that this will take the same downward trend of previous infractions.
  - etchalon 5y ago
    Are you under the impression that people who teach logic are unaware of real world evidence that "things change and some of the those end up being bad"?
    - colordrops 5y ago
      No, I am under the impression that in this thread we are using the term "slippery slope" to mean something else that the one you provided in the link. Also your characterization of "things change and some of the those end up being bad" is not the nature nor specificity of the evidence in this case. Lastly, perhaps you should remain consistent and not utilize the "appeal to authority" fallacy.

revolvingocelot 5y ago

I remember when they put a fucking U2 album on everyone's phone. Remember that? Many found that suspicious, but I recall people like you saying "oh Apple can write, who cares, but they'd never read, you're being ridiculous". I remember when an Apple auth server went down and no one could launch non-Apple applications because Apple needed to see the hashes of the things people ran on their computers.[0] When will the slope be inclined enough for you?! [0] https://mobile.twitter.com/llanga/status/1326989724704268289 https://mobile.twitter.com/llanga/status/1326989724704268289

aaomidi 5y ago
The OCSP example is stupid and people should stop using it. Apple was following an RFC written specifically because PKI sucks.
- revolvingocelot 5y ago
  I'm sure I'll be revealing my ignorance here, but what does revoking certs have to do with Apple needing to know who's running youtube-dl or tor or anything else? Was the revocation of something somehow contingent on the specific application being run, or vice versa?
  - aaomidi 5y ago
    Apple requires signing of code that's going to run on MacOS. You can disable this, but it is a nice little security feature that allows Apple to quickly react if a virus starts spreading on their devices. They revoke that certificate and OCSP (which is a standard way of checking for revocation) blocks that software from running. Apple's design was fail closed, so if OCSP is down, assume the application has had its key revoked. Unfortunately that's just how OCSP is, your browser (if you're using Firefox) does this with CAs. The unfortunate thing is, due to the nature of desktop applications, OCSP stapling doesn't really work when you're not the one serving content.
    - revolvingocelot 5y ago

hncurious 5y ago

You're right, but isn't the rapid expansion of censorship and surveillance the past year evidence that we are currently slipping down the slope?

spockz 5y ago

Just the other day in the Netherlands it came out that cameras placed with the strictest promise that they would only record license plates and only trigger when it matched with a known license plate now also capture persons in the car. And before that the systems were changed to store pictures for 28 days in order to look back. It also came out that the deletion doesn’t always work and that the obfuscation that is supposed to happen also doesn’t always happen. The reaction of the police seems to be “why do you care about this? We have the data let’s use it. And we could use it to find those ~killers~ these people that allegedly just killed the most popular crime news reporter. So let us do our work.” Just like software expands to eat cpu/memory/disk resources and people start living up to their salaries: whatever is possible will happen. To me the slippery slope argument is perfectly valid.

etchalon 5y ago
I look forward to the day that marrying your hamster is legal.

longtom 5y ago

Edward Snowden's revelations provide very solid evidence that what can be done is being done.

Zak 5y ago

Prior to this change, they couldn't. Now they could. It's much easier to change the policy than to add a new mechanism. Governments, including the US government have previously attempted to force Apple to break into users' devices, and often apply gag orders to such attempts. Now they could, and that's enough for me to be unwilling to keep sensitive information on an iOS device.

etchalon 5y ago
You do not seem to understand what was actually implemented.
- Copernicron 5y ago
  In what way does the OP not understand what was implemented? This gives apple the ability to monitor any file on your device. Not only that, but all we have is the government's pinky promise that the database contains only CSAM. There is no verification. How do we know that it isn't going to end up filled with gay pornography involving consenting adults when the "feature" is rolled out in Saudi Arabia?
  - etchalon 5y ago
    How do you know that the image classifier on your iPhone, that exists today, and detects faces, isn't also detecting whether the photo has a gun in it?
    - skinkestek 5y ago
      We don't know, but a photo of a gun isn't going to break your marriage, make you lose your job, make your friends hate you and get you thrown into jail for weeks. Someone finding a way to plant this kind of material on your phone does that. Besides, the fact that something that can be misused exist isn't a very good defense for creating something else that widens the opportunity for abuse significantly.
- Zak 5y ago

wyager 5y ago

Slippery slope is a shockingly predictive heuristic.

etchalon 5y ago
It very, very rarely is.
- skinkestek 5y ago
  If anything, the last decade has been a huge slippery slope. If you haven't noticed jokes is on you.

hapless 5y ago

Well, there's not really any slope here. Apple plans to have a target database of BAD FILES!!1! that will get your name handed to the government. It's not subtle. No expansion to the program is necessary to violate your privacy or endanger dissidents.

randyrand 5y ago

Slippery slope? What they already announced is abhorrent. Scanning all of our photos against our wishes? Who cares what it's for? The fact that they are even doing this at all is a huge infringement to their customer's autonomy.