4 ms·

It is generally a good practice to steelman the opposing argument. In this case, the steelman is that Apple has turned a capability barrier (if your scanning i

It is generally a good practice to steelman the opposing argument. In this case, the steelman is that Apple has turned a capability barrier (if your scanning is on the cloud, you simply cannot scan local photos) into a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.)

JimDabell 5y ago
> a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.) This is not the case. People are guessing about how it works and getting it wrong. The device doesn’t know if there’s a match or not. The logic is not “if there’s a match, tell Apple”, the logic is “attach a safety voucher to every iCloud upload and let Apple figure it out on the server”. You can’t flip a switch and just run it against all photos on the device – the iCloud upload is a part of the design. If Apple wanted to scan all the photos on your device, they would have picked a different design for this. If Apple change their minds and want to do this in the future, they need to redesign how this works, it’s not just a policy decision.
- howinteresting 5y ago
  There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? The safety voucher logic is layered on top.
  - JimDabell 5y ago
    > There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? Yes, but that method is on the server. The client doesn't know which images match, so it can’t scan all photos and decide to upload the ones that match. From Apple: > On-Device PSI Protocol. Given a user image, the general idea in PSI is to apply the same set of transformations on the image NeuralHash as in the database setup above and do a simple lookup against the blinded known CSAM database. However, the blinding step using the server-side secret is not possible on device because it is unknown to the device. The goal is to run the final step on the server and finish the process on server. This ensures the device doesn’t know the result of the match, but it can encode the result of the on-device match process before uploading to the server. – CSAM Detection Technical Summary: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

JimDabell 5y ago

> a policy barrier (now you can scan all photos, there's just a flag in the software which means you don't do so.) This is not the case. People are guessing about how it works and getting it wrong. The device doesn’t know if there’s a match or not. The logic is not “if there’s a match, tell Apple”, the logic is “attach a safety voucher to every iCloud upload and let Apple figure it out on the server”. You can’t flip a switch and just run it against all photos on the device – the iCloud upload is a part of the design. If Apple wanted to scan all the photos on your device, they would have picked a different design for this. If Apple change their minds and want to do this in the future, they need to redesign how this works, it’s not just a policy decision.

howinteresting 5y ago
There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? The safety voucher logic is layered on top.
- JimDabell 5y ago
  > There is still a local CSAM database and still a method somewhere that returns a probability that an image is in the database, isn't there? Yes, but that method is on the server. The client doesn't know which images match, so it can’t scan all photos and decide to upload the ones that match. From Apple: > On-Device PSI Protocol. Given a user image, the general idea in PSI is to apply the same set of transformations on the image NeuralHash as in the database setup above and do a simple lookup against the blinded known CSAM database. However, the blinding step using the server-side secret is not possible on device because it is unknown to the device. The goal is to run the final step on the server and finish the process on server. This ensures the device doesn’t know the result of the match, but it can encode the result of the on-device match process before uploading to the server. – CSAM Detection Technical Summary: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...