17 ms·

There’s a crack in the iPhone foundation and it could get a lot worse

• edrxty 5y ago
  Arguments about CSAM aside, I think this is the final nail in the coffin of walled gardens and closed devices. If a company can unilaterally swoop in and throw the EULA out the window on a device you bought years with absolutely no recourse then what are we supposed to do?
  • gameswithgo 5y ago
    Don't buy it
    • edrxty 5y ago
      That's becoming less of an option by the day and will only accelerate if Apple gets their way.
      • alttab 5y ago
        Literally just get an Android phone.
        • fredsir 5y ago
          If you think it's not spreading to Android phones, you are naive. Apple set the precedent, now it's gonna come to every mainstream device. The only option is to abandon ship.
          • cmurf 5y ago
            For a split second I lamented the demise of Windows Phone. But they too would just follow. But I do lament the end of Firefox OS.
        • edrxty 5y ago
          Sure, now find me a new car that doesn't have the ability to do OTA updates
          • alttab 5y ago
            Assuming the marketplace is functioning, the demand for these sort of "features" (aka: non-features) would assume there would be a rational supplier to give it. The next step in that debate is "yeah but the big monopolies are making it impossible for a little guy to get in." Which is true. We can agree the regulatory capture is bad. In the meanwhile, Google is not openly saying they will run ML on your images on your phone. With Android, you don't have to sync to the cloud, and you could even replace or add your own camera option. You can side-load without jailbreaking, etc. Now, not that most consumer friendly option, but the advice for this crowd is still good - if you still have an iPhone and this is the last straw for you, there are plenty of good options that still exist, today. And then - let's fight regulatory capture and big government so a more dynamic marketplace can take root.
            • edrxty 5y ago
              Sure, but I already have an android. The concern I have is that the regulatory landscape will change if Apple opens Pandora's box. Google could just as easily do the same thing, hampered only by their complete inability to keep androids updated. I have a pine phone but what happens if the Congress critters decide everyone should have this feature and networks should ban devices that don't. The point is that we're REALLY playing with fire here.
            • notriddle 5y ago
              > Assuming the marketplace is functioning It's not. That's the problem.
            • handrous 5y ago
              > Assuming the marketplace is functioning, the demand for these sort of "features" (aka: non-features) would assume there would be a rational supplier to give it. The assumption that a "functioning" market will do a good job of catering to even fairly popular wishes does not seem to hold true in the real world, including for cases in which I'm pretty damn sure it's not some kind of government interference causing it not to. It's utterly common for plain ol' commodities subject to no special government scrutiny or control and with many suppliers to provide no option for features or product-types that would surely have many buyers, simply because no-one expects the returns to be as high as doing something else with the same capacity. AFAIK this happens for a bunch of reasons, including that information is very, very far from being perfectly shared in all parts of the market, that there are significant costs associated with quality information-gathering, and efficient use of capital tending to cause production to cluster around tiny little bits of the possible product space (similar to how pharmacies like to build right next to each other, rather than spreading out to reduce travel-time-to-a-pharmacy in an area)
        • zepto 5y ago
          Google’s photo library already scans for CSAM.
          • nsizx 5y ago
            But not in your device.
            • zepto 5y ago
              No - it’s worse than that. They can scan for anything they like. They have made no promises about limiting what they do.
              • nsizx 5y ago
                Source?
                • zepto 5y ago
                  https://support.google.com/transparencyreport/answer/10330933?hl=en#zippy=%2Cwhat-is-googles-approach-to-combating-csam%2Chow-does-google-identify-csam-on-its-platform%2Cwhat-is-csam https://support.google.com/transparencyreport/answer/1033093... https://www.theguardian.com/technology/2014/aug/04/google-child-abuse-ncmec-internet-watch-gmail https://www.theguardian.com/technology/2014/aug/04/google-ch...
                  • nsizx 5y ago
                    Nothing in those links says that Google can scan the pictures you store in your device using your own device to do the scanning.
                    • zepto 5y ago
                      You seem to be confused about what Apple is doing. Nothing anywhere says that Apple scans the pictures you store on your own device. They only scan the pictures you upload to their cloud service. The scanning is done on device before upload in Apple’s case, and in the cloud after upload in Google’s case, but either way it is only done to photos that are uploaded to their cloud services. If you are really claiming Apple scans the photos you don’t upload to iCloud Photo Library, then you are lying or dissembling. I assume that is not what actually what you mean.
    • echelon 5y ago
      Regulate it. The FBI/CIA/CCP are not the people we elect. My representative is behind the charge to undo the app store monopoly. We can also push for less surveillance, less centralization of power, etc. It seems if the OS vendor doesn't get to have a default browser, default app store, and default cloud store, that they don't get access to scan your files without asking either. Legislate.
      • csw-001 5y ago
        Agreed. Democratically decide where the lines are, or ought to be, then move those lines with amendments and revisions as needed. Judge those lines in the broader context of our legal system. We balance these issues in the physical world with warrants and judicial oversight - that's what we need here - sensible middle ground the democracy can live with.
    • nzeribe 5y ago
      "Consumer choice" is not how you stop hostile all-pervasive monopoly machine learning algorithms. The number of times I've heard from smart people: "Don't use Google"; "Don't use Amazon"; "Microsoft are evil" (true) - now "Don't buy it". Running into the hedgerows and away from the mainstream of digital life is not an option for all but a tiny fraction of people. "Just get an Android phone!" is an even worse idea.
      • arsome 5y ago
        I have to disagree - privacy requires openness. Indeed, "just get an Android phone" from Google, OnePlus and several other major manufacturers is a viable solution - they allow you full control over the device without their permission. You don't want Google? No problem, blow the ROM away and install Lineage without GApps, you can even mess with MicroG if you're reliant on some app that needs Play Services.
        • zepto 5y ago
          In terms of avoiding CSAM detection they give you no more control than Apple. If you use Google’s Photo Library, your photos have already been scanned.
        • causi 5y ago
          Well, almost. Both of them have their "fuck the user" quirks. Oneplus spent a goodly amount of time exfiltrating private data to their own servers until they got caught and Google has a bad habit of disabling features like HDMI-out to force you to buy their other products like Chromecast.
        • dghlsakjg 5y ago
          That's an option for the tech literate. I want an option that is "grandma" compatible. In other words, it isn't really viable if you can't just buy it off the shelf, or have to dig into settings to opt out. Right now if I go to Best Buy (or insert your favorite retailer here), I can't buy hardware off the shelf that won't send my data to a remote server by default.
        • NexRebular 5y ago
    • lamontcg 5y ago
      You dropped your "/s"
  • kevin_thibedeau 5y ago
    You agreed to let them alter the terms of the deal. It's in the EULA.
  • Andrew_nenakhov 5y ago
    Apple is altering the deal. Pray they don't alter it any further.
  • GekkePrutser 5y ago
    I really wish this would be the end of it. But 99% of consumers will keep buying into these walled gardens and will forget about all this within a week if they even heard of this in the news. Because the next iPhone will come in pretty purple that they absolutely must have.
    • bengale 5y ago
      I think when most people understand what the thing is doing they either don’t care or actually agree with it. There’s a large overlap with tech people and people that have strong privacy feelings. If you chat with normal people they are generally completely onboard with scanning for this type of material. I had quite a hard time explaining to some people why the anger towards this wasn’t pro-pedo essentially because they couldn’t understand why anyone would be against these people being found.
  • zepto 5y ago
    Which part of the EULA is being thrown out?
  • RC_ITR 5y ago
    >In short, Apple has built a CSAM detector that sits at the doorway between your device and iCloud. If you don’t sync photos with iCloud, the detector never runs. If you don't want your photos scanned, turn off iCloud. You can disagree about whether or not that's anti-consumer, but you cannot argue they are changing anything about your device or it's EULA (they are changing the EULA of a service).
    • busymom0 5y ago
      I am curious how that works for iMessage. In the example screenshots they shared, they show their scan runs on iMessage too. Is there a way to disable that? Also disabling iCloud would be an option if they allowed for third party backup/sync apps to run background tasks.
      • websites2023 5y ago
        >Is there a way to disable that? It's a feature of Communication safety in Messages. This is opt-in. https://www.apple.com/child-safety/ https://www.apple.com/child-safety/
        • busymom0 5y ago
          You are right. Though that’s opt in “for now”.
      • bengale 5y ago
        You may be confusing CSAM detection for iCloud Photo Library with a new parental control feature for under 13s in the messaging app.
        • busymom0 5y ago
          Ah so the csam detection doesn’t apply to incoming iMessages? (For now at least I guess- who knows about what Apple decides to do once this gets adopted).
  • sschueller 5y ago
    Final nail is when Apple starts preventing you from installing non approved apps on your PC. It's coming and the excuse will be security. Sorry, you can't install this bit torrent client or this crypto wallet...
    • q-rews 5y ago
      You know it can’t happen. If developers jump ship who’ll fill their app stores?
      • kyriakos 5y ago
        It's a catch 22 cause developers want to sell their apps so they will still comply
      • sschueller 5y ago
        They don't care about developers. Touch bar ESC key, thinnes instead of performance etc.
    • jclardy 5y ago
      Apple is already doing that with iOS and iPadOS. Apps are already taken down from the App Store in China at the request of the government.
  • Kenji 5y ago
    You're a dumbass for buying Apple, the writing was on the wall for ages. Don't buy Apple, buy and use devices that are under your control. How the fuck is that so hard to understand, we've been telling you people for literal decades.
  • demosito666 5y ago
    The final nail as in nobody will give a shit about it and Apple's revenue will continue to rise? Because this what will happen and was happening for the last decades.
• shishy 5y ago
  > In short, Apple has built a CSAM detector that sits at the doorway between your device and iCloud. If you don’t sync photos with iCloud, the detector never runs. Is this correct? I have just read conflicting things about this online, I think even Ben Thompson wrote that it runs on the device too?
  • czzr 5y ago
    It is correct, but it’s also true that it runs on the device. It’s actually an interesting trade-off as it’s more private in some ways, at the cost of potentially being less private if misused in the future.
  • CGamesPlay 5y ago
    Both statements are correct--for now. It runs locally on device for photos synced to iCloud. Presumably it's a slow boil: they'll make it run on all photos in a year or so, once the press from this one has blown over.
    • shishy 5y ago
      Thanks (to you and the other responders) for clarifying; that makes sense. Bit of a shame... I wish it just sat elsewhere on their server before cloud syncing and then I could just disable cloud sync + use the phone without worrying.
      • jnwatson 5y ago
        There's the rub. I think folks would feel better about if Apple-owned equipment was doing the scanning, even though arguably it is worse for privacy.
    • notJim 5y ago
      > Presumably it's a slow boil: they'll make it run on all photos in a year or so, once the press from this one has blown over. What is the basis for this assumption?
      • 5y ago
• choeger 5y ago
  I strongly disagree with the author. Apple did this feature not for "increased privacy" or "better cloud security". Sorry to say that but that's a desperate believer right there. Why did Apple do it, though? To create precisely this kind of cognitive dissonance. It's not Apple that's observing you. It's the government. Apple has basically created an API for government surveillance and can now say "see, we don't collect the data. We don't even know what big brother wants to know about you." Apple just side-stepped the question on how to reconcile trust in propietary software and surveillance requests from the government. And everyone who tells you that it's not guaranteed that this feature will be extended to texts, spoken language, and other contents, is not worth talking to. We now live in a world, where our personal computers come with "AI" that detects illegal use of those computers and automatically turns us in to the authorities. This general pattern won't disappear, ever. In a couple of years you will have to carefully consider every word you say in a car, every movie you watch, every website you visit, every program you write, because some neural net will use it to create a fingerprint that might be classified as illegal behavior.
  • Clubber 5y ago
    You could just get a cell phone that you can turn off. I think they still make them, but get them while you can. Eventually that won't work, because your car will be able to observe you just as easily probably. I have an old razor flip phone I might start using again. That and an iPod touch with no cellular. This is here to stay. Time to adapt to it.
    • jimbob45 5y ago
      Can’t you “turn off” anything by just sticking it in a Faraday cage to block it from phoning home?
      • Clubber 5y ago
        You can block the signal, but since the new scanner is now on the device itself, it can still snoop and phone home later. I want a phone that I can use as a phone still but be able to control when it does stuff and what stuff it does. I don't need a portable computer if it's just gonna spy on me all the time.
• birdyrooster 5y ago
  What if this own goal was done on purpose as way to prove the business cannot sustain this level of intrusion? It could be a piece of a larger game to build a case against Congress trying to force its hand further. The outrage has got people politically motivated. It could be weaponized against the surveillance state.
  • badkitty99 5y ago
    It does seem kind of odd, the level of outrage, compared to other similar issues with apple. The blowback feels coordinated, at least
• jt2190 5y ago
  > With its on-device CSAM scanner, Apple has built a tool carefully calibrated to protect user privacy. If building this tool enabled Apple to finally offer broader encryption of iCloud data, it might even be a net increase in user privacy. > But tools are neither good nor evil. Apple has built this tool for a good purpose, but every time a new tool is built, all of us need to imagine how it might be misused. Apple seems to have very carefully designed this feature to make it more difficult to subvert, but that’s not always enough. > Imagine a case where a law enforcement agency in a foreign country comes to Apple and says that it has compiled a database of illegal images and wants it added to Apple’s scanner. Apple has said, bluntly, that it will refuse all such requests. That’s encouraging, and I have little doubt that Apple would abandon most countries if they tried to pull that maneuver. > But would it be able to say no to China? Would it be able to say no to the U.S. government if the images in question would implicate members of terrorist organizations? And in a decade or two, will policies like this be so commonplace that when the moment comes that a government asks Apple or its equivalents to began scanning for illegal or subversive material, will anyone notice? The first implementation of this technology is to stop CSAM, and nobody will argue against trying to stop the exploitation of children. But will there be a second implementation? A third? I’ll add this: Is our outrage at Apple enough to stop governments from requiring that they implement features like this?
• xwdv 5y ago
  What if pedophiles and child molesters weren't demonized, but instead treated as victims of some mental disease that requires rehabilitation and treatment so they can be normal members of society? Just kidding, hunt them down and send them to hell.
• swiley 5y ago
  The foundation is made of sandstone and full of cracks and mud from the beginning; you never had root or the ability to replace the kernel. Apple has always been able to do whatever they want and they've rented that privilege to carriers and law enforcement in the past.
• mensetmanusman 5y ago
  I hope people who are mad at Apple and who also criticize people for using the ‘slippery slope fallacy’ reassess their criticisms of those that try to predict negative outcomes. Slippery slope means something different than you think it means.
• helen___keller 5y ago
  I take issue with most of the alarmism about this CSAM scanning. Not because I think our devices scanning our content is okay, but because of the implication that there's now a slippery slope that didn't exist before. For example, from the article: > While today it has been purpose-built for CSAM, and it can be deactivated simply by shutting off iCloud Photo Library syncing, it still feels like a line has been crossed Two simple facts: (1) The system, as described today, isn't any more invasive then the existing CSAM scanning technologies that exist on all major cloud storage systems (arguably it's less invasive - no external systems look at your photos unless your phone flags enough of your photos as CSAM, which brings it to a manual review stage) (2) Auto-updating root-level proprietary software can be updated to any level of invasion of privacy at any time for any reason the provider wishes. We aren't any closer to full-invasion-of-privacy with iPhone than we were before; it is and always has been one single update away. In fact, we don't know if it's already there on iPhone or any other proprietary system such as Windows, Chromebook, etc. Who knows what backdoors exist on these systems? If you truly believe that you need full control and a system you fully trust, don't get a device that runs proprietary software. If you're okay with a device that isn't fully trustworthy, but appears to be benevolent, then iPhone isn't any worse than it was a month ago. Until there's evidence otherwise, iPhone will continue to be as trustworthy as any other proprietary closed-source system. If you need more than that, please contribute to projects that aim to produce a modern, functional FOSS smartphone.
  • stetrain 5y ago
    I agree with (2). But I do think there is a fundamental (human, psychological, emotional) difference between a tool running on a server and one running on my device. The mental and ethical lines are clear when I hand content to a server, that's a contract I can understand and agree to. When it runs on my device, even if it's because of the option to send it to the server, that feels fuzzier. As Ben Thompson put it it's the difference between Capability and Policy. This is now rubbing in our faces that the privacy is only in the policy, not the capabilities of the software. And the capabilities of propriety software are pretty knowable, through a combination of inspection and long term observation. The end result isn't any different today, but it highlights the political position that Apple and others are being put in. I honestly don't fault Apple for this on anything except their clearly poor messaging, but they are getting pulled from all sides by governments who don't like the idea of them actually implementing a fully closed and end-to-end encrypted system for user data.
• cproctor 5y ago
  Can anyone recommend a good framework or analysis of the barriers to open-source, general-purpose computing on mobile devices? I have read with interest the various open-source mobile operating systems posted to HN, but don't feel like I have a good sense of the landscape. Switching to open source feels urgent (mobile has become so important and so privacy-invasive), but it also feels like this is a steep uphill battle; that mobile has been culturally positioned as not-for-open-source. I'd love to see this problem analyzed in terms of layers. My sense is that one barrier is walled-garden apps. I'm happy to give these up. But I also have the sense that there are hard barriers involving firmware (especially cellular modems?), identity (SIM cards are designed to contain secrets you can't access), and connectivity (you can't decouple a phone number from its client as easily as you can with an IP address).
  • teddyh 5y ago
    Purism, the makers of the Librem 5 phone, have addressed these issues many times in their news/posts: https://puri.sm/news/ https://puri.sm/news/
  • swiley 5y ago
    Non-free graphics drivers and the incompleteness of gnome-calls and libpurple-sms. Those two are really the main issues.
  • swiley 5y ago
    (Sorry to reply twice but my noprocrast timer is still running out.) If you want it in wiki/git form: postmarketos.org is the project you're looking for as far as stuff on the application processor goes. Most people prefer to treat modems as black boxes due to the belief that modem firmware needs go through regulatory testing (I'm not too sure that's true but I've only done WiFi stuff.)
• perryizgr8 5y ago
  IMO this was bound to happen the moment users accepted that they didn't have root on their hardware, and handed the keys to the manufacturer. It's a slippery slope. Apple is as much in control as we are. We are all just sliding down the path set years ago. Today it's scanning your photos. Tomorrow it will periodically turn on the camera, do on device processing to check for child abuse, then only send the recording to FBI if it thinks so. Otherwise the recording will be deleted. Once you cede control over your property, this is bound to happen sooner or later.
• arthurz 5y ago
  This how is a micro Communism starts. So far within one strong monopoly. Two things need to happen right away: new electronic hands off data protection legislation and Apple's monopoly dismantled. Not to forget the right for repairs by ordinary users.
  • freddybobs 5y ago
    Micro "Communism"?! You are aware what communism means... https://en.wikipedia.org/wiki/Communism https://en.wikipedia.org/wiki/Communism So no - not communism. Fascism? Authoritarianism? Perhaps? Agree we need right to repair for ordinary users and also agree we need data protection/privacy legislation.
• abvdasker 5y ago
  Every overreach in surveillance of the last 30 years has been justified as a way to stop child porn or terrorism. Law enforcement deliberately chooses these issues because they know they are an easy way to manufacture consent for greater surveillance. Mission creep isn't hypothetical. Many of the provisions in the Patriot Act are now completely entrenched and still used to today for drug enforcement and petty crime.
• justicezyx 5y ago
  Hahah, if you ask Tim Cook he probably would tell you that there are a lot of cracks in the iPhone foundation. Alas, that's why this guy was paid that much... But anyway, media being media, not bad to waste a few minutes feeling good about oneself that one can form an opinion about such a huge and powerful corporation.
• neurobashing 5y ago
  An interesting thing in this whole tempest is the notion of the CSAM itself. Specifically, there are more than a few people whose argument against Apple seems to be, implicitly, that CSAM is something of a moral panic. It exists but not at the scale that Apple needs to embed this technology in every device. Other posts alleged NCMEC lies about stats, ostensibly to justify their budgets (if CSAM is not a growing problem, then they don't need more funds). Others insist that the existing means of policing don't work in an increasingly technical world; and the bad guys are good at this stuff. I don't know which side is right - or if there even is a "right", here. To me, then, the whole thing at least partly rests on those questions. If CSAM is a moral panic, then this technology is not just bad, but doubly so. Apple got played by the Feds, or maybe they really have been dreaming of backdooring their devices and finally had the rationale they needed. But if CSAM isn't a moral panic but an actual growing problem that needs a technical solution (or assist), what are we to do? Just shrug and say "well it's a hard problem, maybe one day we'll solve it" and hope for the best?
  • freddybobs 5y ago
    This article on HN today https://tutanota.com/blog/posts/wer-wird-belauscht/ https://tutanota.com/blog/posts/wer-wird-belauscht/ "Politicians regularly claim that they need to ban encryption to protect the children. But who is actually being monitored?" Apparently by orders of magnitude over any child related issue, it's drugs. That seems to imply that it is a "moral panic". If they said they were doing for drugs, or drugs + other stuff then that might be more convincing. Moreover if the article is to be believed - such mechanisms are used at hugely higher rates for things they are not pitched as being for. So that breaks the narrative of 'we'll only use it for X'.
• marticode 5y ago
  This is a very kind, and naive take on the issue. Case in point: > But would it be able to say no to China? In order to keep selling on the Chinese market, they already agreed to host their Chinese customer data inside China with a local cloud provider, and censor content according to Chinese requirements, and fully comply with the CCP requests. So once the "tank man" photo is added to the list of banned pictures, there's no doubt they'll happily comply.
  • swiley 5y ago
    China is a nice canary. If it's legal there then it's probably no good.
• kilroy123 5y ago
  I really hope what comes out of all this, is developers and money flowing into linux phones. Pinephone looks good in theory but it sounds like it is not there yet. We need more options than just Android or iOS. Sure Android is "open sourced" but we all know its limited without all the Google things also installed. We need a true third competitor.
  • kiawe_fire 5y ago
    I hope for this as well. The best time to build up freedom-focused big-tech alternatives is before things become dire, not after. Having had time to cool off, my response to this is to continue using Apple devices and supporting their privacy-focused way of CSAM scanning rather than the worse alternatives. BUT, I'm going to start buying and supporting alternatives in parallel, and eventually start contributing to them. If my biggest concern is government overreach, yet I think that we're "not there yet", then its incumbent upon me to be a small part in helping to make sure the alternatives are ready once we do "get there".
  • weikju 5y ago
    This has finally pushed me into finally getting a liberapay account and donating to a few projects, mostly related to XMPP and mobile Linux. My reasoning being that in the FOSS world there's not a single company you can pump funds into (Pine64 does not proft much or at all from their devices, and Purism is just one company, not yet shipping the phones in large quantity), but individual developers scattered all over the world DO contribute and DO need our support. It's the only way, until we get more Pines and more Purisms (minus the drama).
• EGreg 5y ago
  Can someone please explain why we are against even the smallest reduction in End-to-end encryption by a single vendor you can avoid using (iCloud) but then talk about cryptocurrencies, for example, as "enabling black markets and economies". Don't you see that it's two sides of the same coin, and end-to-end encryption can easily enable any sort of privacy coins and anonymity? We as advocates need a consistent position, otherwise we just have a gaping double standard. If you're worried about anonymous transactions in crypto, because they can lead to, say, money laundering or financing terrorism, why are you not worried about end-to-end encrypted communication by those same terrorists?
  • no_time 5y ago
    If that makes you feel better, I advocate for both.
• cataphract 5y ago
  > This all leads me to believe that there’s another shoe to drop here, one that will allow Apple to make its cloud services more secure and private. > If this scanning system is essentially the trade-off that allows Apple to provide more privacy for its users while not abdicating its moral duty to prevent the spread of CSAM, great. Even assuming this other shoe drops, then this logic implies that there is a moral duty to implement other types of scans to prevent other serious crimes. Surely Apple shouldn't abdicate its moral duty to prevent murder. There's really not much of a limit to this argument. As long as there is the level of false positives is similar to that of the technology now being implemented, there is a moral duty for Apple to deploy the surveillance methods.
  • heavyset_go 5y ago
    > Even assuming this other shoe drops, then this logic implies that there is a moral duty to implement other types of scans to prevent other serious crimes. Surely Apple shouldn't abdicate its moral duty to prevent murder. There's really not much of a limit to this argument Over 70,000 Americans die from overdoses each year, which is nearly double that of yearly vehicle fatalities. If Apple is already scanning photos and messages, why not save tens of thousands of lives while they're at it by detecting heroin and fentanyl dealers, too?
    • deleted 5y ago
      [deleted]
  • zug_zug 5y ago
    Exactly. How about we put it this way: "CSAM is a problem, but corruption within politics is more of a problem. Apple, morally, really has no choice BUT to monitor all politician communications and police communications looking for certain suspicious or risky phrases." The camera is facing the wrong direction...
• busymom0 5y ago
  Few years from now, most people would be totally okay with Apple letting random governments coerce them into putting “illegal” non CP related photos to their database in the name of “national security” or what not. All it takes is one tragedy for the population to give up their principles and rights in the name of tiny bit of “safety”. Just a decade ago, freedom of speech used to be something most people would fight for even for things they opposed and found offensive. Now a days, people make excuses why companies coerced by governments are totally fine with censorship because “it’s just a private company”. “It’s a private company” principle is how censorship is done in authoritarian countries too- private companies simply do the job of the governments. I have zero hope for the future of free internet. Soon journalists like Julian Assange and whistleblowers like Snowden would be even easier to shut down and track down in the name of “national security” which Apple has made easier to do.
• new_realist 5y ago
  This is the best Apple can do. Apple can’t say to governments that client-side scanning is impossible, because it obviously is. In fact it’s quite easy. There is no magic technical fix, but at least Apple has preserved e2e encryption of cloud data. This is a political/societal issue; Apple is subject to the rule of law like everyone else. Contact your elected officials if you want it changed.
  • least 5y ago
    No, there's no regulation or law requiring this sort of action. Everyone is speculating it is Apple's response to a foreseen future where there are laws requiring such technology to preserve some amount of privacy, but it absolutely is not a current requirement in the US. They could have implemented true E2EE but they chose not to in deference to law enforcement and they could have fought the battle there. The amount of speculation being done on Apple's behalf here is baffling. I think Jason's take is pretty measured and it's pretty clear that he's uncomfortable with this, especially given his long history with reporting on Apple but he is also pushing this false dichotomy.
    • nazgulnarsil 5y ago
      You're assuming that if there's no explicit law there is no other avenue governments have to put pressure on Apple. This seems to go against previous stories that have come out about the relationship between eg government and google.
      • least 5y ago
        Right, which is why there's no bite behind their remarks about resisting government imposition. They could have implemented E2EE and fought the government about it openly, but they didn't. Now, I really doubt the only reason they didn't implement E2EE was because of government pressure because making E2EE an invisible feature (which Apple loves to do) is a difficult task. I will however plainly state that the option of creating spyware to scan images on your phone with E2EE on the cloud or neither of these features being able to exist is a false dichotomy that is being pushed as a narrative by a lot of people.
• comeonseriously 5y ago
  All arguments aside for a moment, do they just not see the logical inconsistency here? >Apple’s Head of Privacy implies that it’s because it was ready, but that’s a bit of a dodge—Apple has to choose what technologies to prioritize, and it prioritized this one. Apple didn't have to prioritize this ahead of anything in order for it to be ready to ship. They could have been working on it in the background for some time.
  • pseudalopex 5y ago
    Working on it in the background would have made it a higher priority than everything they weren't working on.
• 1024core 5y ago
  If you read old spy novels, you'll read that one way foreign spies recruit domestic spies is by first asking them to do innocuous stuff ("send us some newspaper clippings"). Once they have them doing that, it is easier to get them to break the law and pass over _real_ secrets. In other words, "just the tip". This move by Apple is the proverbial tip. Eventually you can bet Apple will let governments upload not just hashes of CSAM, but "hashes" of faces they'd like to monitor. Or objects in images (maybe weapons, or chemicals, etc.) I am so glad I don't use any Apple products.
  • deleted 5y ago
    [deleted]
• stalkingvictim 5y ago
  Counterpoint: If E2EE is, in practical terms, unbreakable, and if the endpoints are hardened, perhaps Apple's client-side scanning initiative is simply an expected result of frustration by law enforcement in criminal investigations. A law enforcement person told me that the CSAM issue is more widespread than the average person might expect.
• atbpaca 5y ago
  I feel very uncomfortable with the potential misuse of this technology and the fact that this is simply a stamped Apple spyware. Another way to go around this is to not update to iOS 15. Let's launch a movement, something like #NotUpdating to send a clear message that our devices are not meant to spy on us. #NotUpdating #NotUpgrading #BoycottApple
• ReptileMan 5y ago
  The whole feature could be killed with a loaded question by a journalist - "Are there that many pedophiles on your platform?". That should be the default whenever government or corporation decide to "protect children" in Orwellian way.
  • bobsterman 5y ago
    I'm pretty sure pedophiles will be looking for another platform following this news. Now any platform that doesn't scan for CSAM will be associated with it.
• mgarfias 5y ago
  I picked up a cheap fire tablet on prime day, mostly to talk to the cars. The UI on that thing is a horrid mess, and I just don’t want to bother wrapping my head around it. But AAPL’s actions of late have me wishing there was a 3rd option for a phone.
• jl6 5y ago
  How long until phones are so not controlled by their users any more, that it becomes a plausible defence to say “that wasn’t me, it must have been the <app or OS vendor> that caused my device to do it”? Conversely, how might Apple implement non-repudiation of user actions? If they control the platform utterly, how can they prove that a user really did something?
  • richardfey 5y ago
    This detection and scanning are going to testify possession of illegal material, not a specific action.
• nazgulnarsil 5y ago
  Why is everyone assuming this is Apple's choice vs the best option they've been handed by USG? Google has scanned for years and apple has clearly come under some pressure on other fronts.
• rektide 5y ago
  I've heard some people saying we ought try to escalate our definition of what "end to end encryption" means, to make the definition exclude platforms where your data at rest is no longer secured by you the end user. It's an interesting argument. My gut reaction is that end to end is still a good definition as is, that we shouldn't update it. This highlights a separate & just real issue, illustrates that encryption still interactupon multiple other layers of platform, which are themselves security issues. But we should try to re-rally around this. There's no catchy pro-user term like "encryption" here, or "end to end". "omniversal encryption," to imply across all time and space, or "end to end, you to me". Finding the right name for this weakness, for what we want & will not accept short of: we should find this flag to fly.
• luckyorlame 5y ago
  Why does the scanning code have to run on the device? Why can't it run in cloud only when a device tries to upload something. Then users can just turn off using the cloud services and retain their naive notion that what's on their phone is really private. When are we doing to see a cloud service provider that matches iCould and other service providers but promises total anonimty
• richardfey 5y ago
  Between this and chat control, future suddenly looks very bleak for those who care about owning their privacy
• new_realist 5y ago
  By Apple moving this process from the cloud to the device, they have the opportunity to make the process transparent and auditable. That would actually be an improvement. Everyone could see what was being looked for, to the point where certain groups could even inspect the image behind every hash.