3 ms·

> The Javascript that checks validity of forms before you submit them is a form of client-side scanning It is hardly difficult to draw a distinction between en

by _jal 5y ago

> The Javascript that checks validity of forms before you submit them is a form of client-side scanning It is hardly difficult to draw a distinction between ensuring a field looks like an expected datatype and ML analysis guessing at photo content. In fact, trying to construct an argument conflating the two pretty much immediately runs in to the fact that one is adversarial, so it only works if you studiously ignore intent.

dane-pgp 5y ago
When you say "one is adversarial", I assume you mean that someone trying to upload illegal files will try to prevent the system from detecting that their files are illegal, while someone filling in a form isn't trying to sneak invalid data past the client-side validator (assuming all hackers know that the system is correctly implemented, i.e. the server performs its own validation). The other distinction is, if a client-side form validator detects a problem with the input, it tells the user so they can fix it, whereas if Apple's system detects a problem with your input, it potentially tells the police without giving you a chance to delete the maliciously-generated false positive files you've unwittingly received.
- _jal 5y ago
  Yeah, 'adversarial' isn't exactly the right word; I'm not sure what is. What I mean is that client side form validation is typically part of a cooperative process - I want to buy something at your store, you want to sell it to me, and smart client side validation can make that faster/easier if I typo something it can catch. It is (or at least should be) mostly aimed at helping the user; your parsing for security is (should be), as you note, on the server. Scanning photos for [CSAM, thoughtcrime memes, poor taste, whatever] doesn't make the user's life easier, is not something anyone asked to be subjected to, and potentially can lead to a very negative outcome for them. That's the distinction I was getting at, and yes, your second point is directly relevant there.

by _jal 5y ago

dane-pgp 5y ago

When you say "one is adversarial", I assume you mean that someone trying to upload illegal files will try to prevent the system from detecting that their files are illegal, while someone filling in a form isn't trying to sneak invalid data past the client-side validator (assuming all hackers know that the system is correctly implemented, i.e. the server performs its own validation). The other distinction is, if a client-side form validator detects a problem with the input, it tells the user so they can fix it, whereas if Apple's system detects a problem with your input, it potentially tells the police without giving you a chance to delete the maliciously-generated false positive files you've unwittingly received.

_jal 5y ago
Yeah, 'adversarial' isn't exactly the right word; I'm not sure what is. What I mean is that client side form validation is typically part of a cooperative process - I want to buy something at your store, you want to sell it to me, and smart client side validation can make that faster/easier if I typo something it can catch. It is (or at least should be) mostly aimed at helping the user; your parsing for security is (should be), as you note, on the server. Scanning photos for [CSAM, thoughtcrime memes, poor taste, whatever] doesn't make the user's life easier, is not something anyone asked to be subjected to, and potentially can lead to a very negative outcome for them. That's the distinction I was getting at, and yes, your second point is directly relevant there.