3 ms·

It seems easy as hell for them to just change the system to do server-side scanning instead of client-side scanning and it would probably be enough to calm the

It seems easy as hell for them to just change the system to do server-side scanning instead of client-side scanning and it would probably be enough to calm the horde. I think people can understand, Apple can't have certain content on their servers. People have a much harder time understanding that Apple needs to make sure you don't have certain content on your phone.

nrabulinski 5y ago
If iCloud content was encrypted (as it should be given what Apple says about themselves and privacy) they wouldn’t and couldn’t care any less what the data on their servers contains since, ideally, they’d have no way of decrypting that data. No need for any privacy invasion! > Apple needs to make sure you don’t have certain content on your phone. Excuse me, what? What does Apple care what I have on my device?
- vineyardmike 5y ago
  > they wouldn’t and couldn’t care any less what the data on their servers Except they're legally forced to care. Thats why this is happening at all. They have a legal obligation to care, encryption be damned. They chose to preserve encryption instead of preserve trust.
  - stjohnswarts 5y ago
    they really don't though. no one can force them to scan a user for anything, however if they do scan and spot CP then obviously they have a duty to report it. Just like you have a duty to report child abuse if you're a teacher. No scans, no CP, no issues. This has been forced on them by the government by some means I think, either the US government or the CCP.
    - vineyardmike 5y ago
      It sounds like (from discussions and links in HN and media) they actually have an obligation to scan any data they host. IANAL and could be wrong.
  - ipv6ipv4 5y ago
    No, they are not. I linked to the text of the law itself [1]. In particular note the section titled "protection of privacy" that states: (f) Protection of Privacy. —Nothing in this section shall be construed to require a provider to— (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b). [1] https://www.law.cornell.edu/uscode/text/18/2258A https://www.law.cornell.edu/uscode/text/18/2258A
stetrain 5y ago
My understanding is they already do server-side. But relying on server-side alone means trying to end-to-end encrypt your data on the server would put them in political/legal crosshairs.

nrabulinski 5y ago

If iCloud content was encrypted (as it should be given what Apple says about themselves and privacy) they wouldn’t and couldn’t care any less what the data on their servers contains since, ideally, they’d have no way of decrypting that data. No need for any privacy invasion! > Apple needs to make sure you don’t have certain content on your phone. Excuse me, what? What does Apple care what I have on my device?

vineyardmike 5y ago
> they wouldn’t and couldn’t care any less what the data on their servers Except they're legally forced to care. Thats why this is happening at all. They have a legal obligation to care, encryption be damned. They chose to preserve encryption instead of preserve trust.
- stjohnswarts 5y ago
  they really don't though. no one can force them to scan a user for anything, however if they do scan and spot CP then obviously they have a duty to report it. Just like you have a duty to report child abuse if you're a teacher. No scans, no CP, no issues. This has been forced on them by the government by some means I think, either the US government or the CCP.
  - vineyardmike 5y ago
    It sounds like (from discussions and links in HN and media) they actually have an obligation to scan any data they host. IANAL and could be wrong.
- ipv6ipv4 5y ago
  No, they are not. I linked to the text of the law itself [1]. In particular note the section titled "protection of privacy" that states: (f) Protection of Privacy. —Nothing in this section shall be construed to require a provider to— (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b). [1] https://www.law.cornell.edu/uscode/text/18/2258A https://www.law.cornell.edu/uscode/text/18/2258A

stetrain 5y ago

My understanding is they already do server-side. But relying on server-side alone means trying to end-to-end encrypt your data on the server would put them in political/legal crosshairs.