5 ms·

I don't understand replies like this one I keep seeing on HN. I thought the controversy around what apple wanted to do was that it was happening on device and n

I don't understand replies like this one I keep seeing on HN. I thought the controversy around what apple wanted to do was that it was happening on device and not in the cloud. The user you're replying to made that distinction so what gives?

godelski 5y ago
A big thing too is that Apple sells itself as privacy preserving. Google doesn't. It's one thing if someone says something they aren't and another thing if someone never makes that promise.
theshrike79 5y ago
Apple's solution was to scan stuff that was going to be uploaded anyway on-device before upload. Using that they could add multiple redundancies and they wouldn't need to look at your stuff on the cloud at all before getting multiple positive matches. And even then the first level is a human checking if it's an actual match or a false positive. This was somehow a huge invasion of privacy, when people were competing on who could misunderstand the very simple premise the most.
- howinteresting 5y ago
  It is generally a good practice to steelman the opposing argument. In this case, the steelman is that Apple has turned a capability barrier (if your scanning is on the cloud, you simply cannot scan local photos) into a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.)
  - JimDabell 5y ago
    > a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.) This is not the case. People are guessing about how it works and getting it wrong. The device doesn’t know if there’s a match or not. The logic is not “if there’s a match, tell Apple”, the logic is “attach a safety voucher to every iCloud upload and let Apple figure it out on the server”. You can’t flip a switch and just run it against all photos on the device – the iCloud upload is a part of the design. If Apple wanted to scan all the photos on your device, they would have picked a different design for this. If Apple change their minds and want to do this in the future, they need to redesign how this works, it’s not just a policy decision.
    - howinteresting 5y ago
      There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? The safety voucher logic is layered on top.
      - JimDabell 5y ago
        > There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? Yes, but that method is on the server. The client doesn't know which images match, so it can’t scan all photos and decide to upload the ones that match. From Apple: > On-Device PSI Protocol. Given a user image, the general idea in PSI is to apply the same set of transformations on the image NeuralHash as in the database setup above and do a simple lookup against the blinded known CSAM database. However, the blinding step using the server-side secret is not possible on device because it is unknown to the device. The goal is to run the final step on the server and finish the process on server. This ensures the device doesn’t know the result of the match, but it can encode the result of the on-device match process before uploading to the server. – CSAM Detection Technical Summary: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
- Duralias 5y ago
  > Apple's solution was to scan stuff that was going to be uploaded anyway on-device before upload. Fairly sure that most of the worry around that was because such a system could very easily be changed to do the same to any photo. And people felt like their phone wasn't theirs and that it could snitch on you. We know that you truly do not own your phone, but most people do not view it that way. Sure, it is technically better than doing that check on on a server, but the general public do not currently view it that way. Personally do not like the system as you would be unable to escape it if it started scanning local photos (which I feel is only a matter of time), something you can with google drive and such, by not using them.

godelski 5y ago

A big thing too is that Apple sells itself as privacy preserving. Google doesn't. It's one thing if someone says something they aren't and another thing if someone never makes that promise.

theshrike79 5y ago

Apple's solution was to scan stuff that was going to be uploaded anyway on-device before upload. Using that they could add multiple redundancies and they wouldn't need to look at your stuff on the cloud at all before getting multiple positive matches. And even then the first level is a human checking if it's an actual match or a false positive. This was somehow a huge invasion of privacy, when people were competing on who could misunderstand the very simple premise the most.

howinteresting 5y ago
It is generally a good practice to steelman the opposing argument. In this case, the steelman is that Apple has turned a capability barrier (if your scanning is on the cloud, you simply cannot scan local photos) into a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.)
- JimDabell 5y ago
  > a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.) This is not the case. People are guessing about how it works and getting it wrong. The device doesn’t know if there’s a match or not. The logic is not “if there’s a match, tell Apple”, the logic is “attach a safety voucher to every iCloud upload and let Apple figure it out on the server”. You can’t flip a switch and just run it against all photos on the device – the iCloud upload is a part of the design. If Apple wanted to scan all the photos on your device, they would have picked a different design for this. If Apple change their minds and want to do this in the future, they need to redesign how this works, it’s not just a policy decision.
  - howinteresting 5y ago
    There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? The safety voucher logic is layered on top.
    - JimDabell 5y ago
      > There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? Yes, but that method is on the server. The client doesn't know which images match, so it can’t scan all photos and decide to upload the ones that match. From Apple: > On-Device PSI Protocol. Given a user image, the general idea in PSI is to apply the same set of transformations on the image NeuralHash as in the database setup above and do a simple lookup against the blinded known CSAM database. However, the blinding step using the server-side secret is not possible on device because it is unknown to the device. The goal is to run the final step on the server and finish the process on server. This ensures the device doesn’t know the result of the match, but it can encode the result of the on-device match process before uploading to the server. – CSAM Detection Technical Summary: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
Duralias 5y ago
> Apple's solution was to scan stuff that was going to be uploaded anyway on-device before upload. Fairly sure that most of the worry around that was because such a system could very easily be changed to do the same to any photo. And people felt like their phone wasn't theirs and that it could snitch on you. We know that you truly do not own your phone, but most people do not view it that way. Sure, it is technically better than doing that check on on a server, but the general public do not currently view it that way. Personally do not like the system as you would be unable to escape it if it started scanning local photos (which I feel is only a matter of time), something you can with google drive and such, by not using them.