5 ms·

Scanning the personal photos on your device and reporting them. They delayed the feature but did not cancel it.: https://www.techradar.com/news/apple-delays-chi

Scanning the personal photos on your device and reporting them. They delayed the feature but did not cancel it.: https://www.techradar.com/news/apple-delays-child-abuse-photo-scanning-planned-for-ios-15 https://www.techradar.com/news/apple-delays-child-abuse-phot...

evv 5y ago
If iOS is anything like macOS, they have already quietly rolled it out. If you're on a mac, even "Big Sur", check to see if the CSAM weights file is here at: /System/Library/Frameworks/Vision.framework/Resources/NeuralHashv3b-current.espresso.weights If you use un-jailbroken iOS 14 of course you can't easily check for the presence of the weights file, so you're already trusting Apple on their word.
- buildbot 5y ago
  That would be such a disgusting move I'd sell all the apple hardware I own right away.
  - evv 5y ago
    I'm not big into "conspiracy" but you gotta wonder why this "NeuralHash" file on my computer exists if "NeuralHash" was supposedly delayed, according to Apple, on an undetermined timeline. If I did want to cook up conspiracy theory, it would be easy: Apple wants to distract from the fact that NeuralHash was broken by researchers. This project apparently is able to create CSAM collisions: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX If NeuralHash is really rolled out, and if this python project can really create collisions, the CSAM system could be DDoS'd by people on their own computers, jamming up Apple's internal censorship review system with false positives. Hence, Apple would be incentivized to sweep this under the rug by "delaying" rollout indeterminately.
    - detaro 5y ago
      The work you link is based on the NeuralHash code shipping with iOS and macOS, and explicitly says so, so there is no reason to theorize if it might already have been in a shipped OS - if it hadn't, we wouldn't have research about its abilities. (What as far as is known - and I suspect it would have been found by people scrutinizing the updates - has not been rolled out is code that actually uses it to implement the reporting mechanisms)
      - evv 5y ago
        Why would they distribute the ML weights file if it isn't being used for logging or reporting? Of course I do theorize that it is actually being used. There is so much network traffic between macOS services and the internet, I'm not sure how easy it would be for researchers to discover if CSAM reporting is enabled. Little snitch detects 292 macOS services on my M1, all talking to the internet. Network experts in Apple probably even have ways of bypassing little snitch.
        detaro 5y ago
        The weights are part of the hash implementation, so not shipping them with the rest of the hashing code would make even less sense.
        hitmyapi 5y ago
        It could potentially be "feature flagged". The client could ship a new version with all the resources/code they need for a specific feature, but a setting on the back-end determines if the feature is enabled or not. That way, Apple could easily toggle this feature on at any point by changing the flag's value on the back-end, without needing to ship an entirely new 15.x.x binary
moooo99 5y ago
I understand the concerns that such a feature might bring, but if I got that right only the photos which are scheduled for upload into iCloud are subject to the scanning. According to reports, the images in iCloud are already subject to CASM scans, but on the server side instead of the client side. So if anything, the on device processing would be a privacy improvement? Am I missing something? Is the technology used on the client side more error prone? Is the process which will lead to the reports different than with the other approaches already in place (including those used by other services such as Google Drive)
- sjtindell 5y ago
  I don’t think you’re missing anything. My personal opinion is it’s severely overblown.
- jrockway 5y ago
  Imagine that you're a lobster, and Apple dropped you into some water. Apple assures you that you're just getting a nice warm bath. Some lobsters are a little nervous given how many other lobsters have been boiled alive after being promised a nice warm bath.
ghostly_s 5y ago
Ok, so why would you be boycotting a specific OS release that did not ship with this feature?

evv 5y ago

If iOS is anything like macOS, they have already quietly rolled it out. If you're on a mac, even "Big Sur", check to see if the CSAM weights file is here at: /System/Library/Frameworks/Vision.framework/Resources/NeuralHashv3b-current.espresso.weights If you use un-jailbroken iOS 14 of course you can't easily check for the presence of the weights file, so you're already trusting Apple on their word.

buildbot 5y ago
That would be such a disgusting move I'd sell all the apple hardware I own right away.
- evv 5y ago
  I'm not big into "conspiracy" but you gotta wonder why this "NeuralHash" file on my computer exists if "NeuralHash" was supposedly delayed, according to Apple, on an undetermined timeline. If I did want to cook up conspiracy theory, it would be easy: Apple wants to distract from the fact that NeuralHash was broken by researchers. This project apparently is able to create CSAM collisions: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX If NeuralHash is really rolled out, and if this python project can really create collisions, the CSAM system could be DDoS'd by people on their own computers, jamming up Apple's internal censorship review system with false positives. Hence, Apple would be incentivized to sweep this under the rug by "delaying" rollout indeterminately.
  - detaro 5y ago
    The work you link is based on the NeuralHash code shipping with iOS and macOS, and explicitly says so, so there is no reason to theorize if it might already have been in a shipped OS - if it hadn't, we wouldn't have research about its abilities. (What as far as is known - and I suspect it would have been found by people scrutinizing the updates - has not been rolled out is code that actually uses it to implement the reporting mechanisms)
    - evv 5y ago
      Why would they distribute the ML weights file if it isn't being used for logging or reporting? Of course I do theorize that it is actually being used. There is so much network traffic between macOS services and the internet, I'm not sure how easy it would be for researchers to discover if CSAM reporting is enabled. Little snitch detects 292 macOS services on my M1, all talking to the internet. Network experts in Apple probably even have ways of bypassing little snitch.
      - detaro 5y ago
        The weights are part of the hash implementation, so not shipping them with the rest of the hashing code would make even less sense.
      - hitmyapi 5y ago
        It could potentially be "feature flagged". The client could ship a new version with all the resources/code they need for a specific feature, but a setting on the back-end determines if the feature is enabled or not. That way, Apple could easily toggle this feature on at any point by changing the flag's value on the back-end, without needing to ship an entirely new 15.x.x binary

moooo99 5y ago

I understand the concerns that such a feature might bring, but if I got that right only the photos which are scheduled for upload into iCloud are subject to the scanning. According to reports, the images in iCloud are already subject to CASM scans, but on the server side instead of the client side. So if anything, the on device processing would be a privacy improvement? Am I missing something? Is the technology used on the client side more error prone? Is the process which will lead to the reports different than with the other approaches already in place (including those used by other services such as Google Drive)

sjtindell 5y ago
I don’t think you’re missing anything. My personal opinion is it’s severely overblown.
jrockway 5y ago
Imagine that you're a lobster, and Apple dropped you into some water. Apple assures you that you're just getting a nice warm bath. Some lobsters are a little nervous given how many other lobsters have been boiled alive after being promised a nice warm bath.

ghostly_s 5y ago

Ok, so why would you be boycotting a specific OS release that did not ship with this feature?