4 ms·

There is hope, and there will be fumbles on the way I think. The real solution is for us all to voluntarily run a CSAM scan on our systems that can trigger a no

There is hope, and there will be fumbles on the way I think. The real solution is for us all to voluntarily run a CSAM scan on our systems that can trigger a notification to a nuetral arbiter (ideally something like an online jury of ones peers, but who don't know you) take a quick glance at the photo, determine it's your kids in the bathtub and not CSAM, and click "It's Fine". We would subscribe to updates to a CSAM scanning corpus which would parameterize the scan. The whole thing requires "trusting the client" but I bet there are ways to make it work. If it would defuse this movement toward total black box checking of content, then I think it's worth it to voluntarily do this kind of scan. The effectiveness presumes that the intersection of child porn consumers and users sophisticated enough to disable a scan like the one I'm imagining is very small.

ggm 5y ago
You're modelling the compliance for good people. Threat and risk analysis has to model for bad actors. Your solution won't work because bad actors exist and will exploit it.
14 5y ago
Why should we run a scan on ourselves? Why should we be treated as a criminal for doing nothing wrong? The solution is to vote out anyone who thinks this is a good idea. To not support any company who tries to implement this kind of technology. It is absurd to think people will give up their rights to privacy in their homes to accommodate this kind of idea. Encryption is math and won’t be stopped. People will find a way to hide what they need any any of these systems only effects the non criminal user. Also I have hundreds of pictures of my kids in the bath. I always try and not get their private parts in the picture but with my hundreds and millions of people potentially with the same numbers it really is not possible for a human to lay eyes on that many pictures. Also that would itself open up avenues for abuse say it was just an innocent picture of my kids butt their are perverts out there that will get off on this. They are private photos of my family enjoying their youthfulness in a bathtub and never will I consent to someone browsing my private photos. This just seems whack.
dannyw 5y ago
Fucking hell, voluntarily running scans on your computers for CSAM? Are you going to voluntarily get a brain wave scan for whether you have anti-patriotic thoughts?
- javajosh 5y ago
  The choice isn't between scans and no scan. It's between voluntary scans (which can be white box and controlled) and involuntary scans (which are black box and totally uncontrolled).
  - StockHuman 5y ago
    That's silly; voluntary scans aren't voluntary if they're to work, and no scans is always an option. Human decisions to do things one way or another have never been set in stone.
  - dannyw 5y ago
    No, the choice is indeed between scans and no scans.
LocalH 5y ago
How about no? I don't view CSAM, and I don't need to voluntarily run a scan to prove I don't.
MereInterest 5y ago
This ended up being a longer post than I intended, but overall I think your entire idea is fundamentally flawed, requires taking control of a computer away from the owner, and wouldn't even solve the issue. > to voluntarily run a CSAM scan on our systems The results of such a scan are meaningless to anybody who doesn't control the computer that performed the scan. If these results are to be trusted by authorities, that implies that we no longer control the computers that you are describing as "our systems". > nuetral arbiter (ideally something like an online jury of ones peers, but who don't know you) take a quick glance at the photo, determine it's your kids in the bathtub and not CSAM, and click "It's Fine". Wait, wait, wait. So the response to finding suspected CSAM would be to make a copy of it, then to deliver that copy TO OTHER PEOPLE OVER THE INTERNET!? Every single study about Facebook's CSAM reviewers shows it to be an emotionally damaging job, because you're constantly shown psychologically damaging material. With that in mind, who do you think would volunteer to be on such a review board? > We would subscribe to updates to a CSAM scanning corpus This introduces an unnecessary failure mode to devices whose core functionality does not require internet access. If I have a digital camera, a tv, or a picture frame, those fundamentally do not require internet access. Given the prevalence of targeted advertising and surveillance of customers, any device requesting internet access should be viewed with immediate suspicion. > The whole thing requires "trusting the client" but I bet there are ways to make it work There aren't. There really, really aren't. You can only trust computers that you control, or that are controlled by people that you trust. Trying to implement these leads to obscenities such as the Clipper Chip, Sony's rootkit, ring-0 DRM, and so on. Every single one takes control of the computer away from the owner and gives it to somebody else. > defuse this movement toward total black box checking of content Your suggestions would require implementing a black box checking of content, running on my computer, and not under my control. Calling it "voluntary" in the sales pitch makes it useless, because the person who controls the computer can disable any reports from it. > presumes that the intersection of child porn consumers and users sophisticated enough to disable a scan like the one I'm imagining is very small The size of the intersection doesn't matter, because only a single person needs to write a script that disables the scan. In addition, if a scan requires sophistication to disable, that implies that it is an opt-in scan, and that goes against your sales pitch as "voluntary".
- 5y ago
anamax 5y ago
> ideally something like an online jury of ones peers, but who don't know you) take a quick glance at the photo, determine it's your kids in the bathtub and not CSAM, and click "It's Fine". How does someone who doesn't know me determine that it's my kids in the bathtub? (The answer can't be "you have to submit other pictures of your kids" because if I can get pictures of random kids in a bathtub, I can probably get other pictures of said kids.)
Dylan16807 5y ago
What a massively invasive system just to find pre-registered images and not prevent abuse at all...

ggm 5y ago

You're modelling the compliance for good people. Threat and risk analysis has to model for bad actors. Your solution won't work because bad actors exist and will exploit it.

14 5y ago

Why should we run a scan on ourselves? Why should we be treated as a criminal for doing nothing wrong? The solution is to vote out anyone who thinks this is a good idea. To not support any company who tries to implement this kind of technology. It is absurd to think people will give up their rights to privacy in their homes to accommodate this kind of idea. Encryption is math and won’t be stopped. People will find a way to hide what they need any any of these systems only effects the non criminal user. Also I have hundreds of pictures of my kids in the bath. I always try and not get their private parts in the picture but with my hundreds and millions of people potentially with the same numbers it really is not possible for a human to lay eyes on that many pictures. Also that would itself open up avenues for abuse say it was just an innocent picture of my kids butt their are perverts out there that will get off on this. They are private photos of my family enjoying their youthfulness in a bathtub and never will I consent to someone browsing my private photos. This just seems whack.

dannyw 5y ago

Fucking hell, voluntarily running scans on your computers for CSAM? Are you going to voluntarily get a brain wave scan for whether you have anti-patriotic thoughts?

javajosh 5y ago
The choice isn't between scans and no scan. It's between voluntary scans (which can be white box and controlled) and involuntary scans (which are black box and totally uncontrolled).
- StockHuman 5y ago
  That's silly; voluntary scans aren't voluntary if they're to work, and no scans is always an option. Human decisions to do things one way or another have never been set in stone.
- dannyw 5y ago
  No, the choice is indeed between scans and no scans.

LocalH 5y ago

How about no? I don't view CSAM, and I don't need to voluntarily run a scan to prove I don't.

MereInterest 5y ago

This ended up being a longer post than I intended, but overall I think your entire idea is fundamentally flawed, requires taking control of a computer away from the owner, and wouldn't even solve the issue. > to voluntarily run a CSAM scan on our systems The results of such a scan are meaningless to anybody who doesn't control the computer that performed the scan. If these results are to be trusted by authorities, that implies that we no longer control the computers that you are describing as "our systems". > nuetral arbiter (ideally something like an online jury of ones peers, but who don't know you) take a quick glance at the photo, determine it's your kids in the bathtub and not CSAM, and click "It's Fine". Wait, wait, wait. So the response to finding suspected CSAM would be to make a copy of it, then to deliver that copy TO OTHER PEOPLE OVER THE INTERNET!? Every single study about Facebook's CSAM reviewers shows it to be an emotionally damaging job, because you're constantly shown psychologically damaging material. With that in mind, who do you think would volunteer to be on such a review board? > We would subscribe to updates to a CSAM scanning corpus This introduces an unnecessary failure mode to devices whose core functionality does not require internet access. If I have a digital camera, a tv, or a picture frame, those fundamentally do not require internet access. Given the prevalence of targeted advertising and surveillance of customers, any device requesting internet access should be viewed with immediate suspicion. > The whole thing requires "trusting the client" but I bet there are ways to make it work There aren't. There really, really aren't. You can only trust computers that you control, or that are controlled by people that you trust. Trying to implement these leads to obscenities such as the Clipper Chip, Sony's rootkit, ring-0 DRM, and so on. Every single one takes control of the computer away from the owner and gives it to somebody else. > defuse this movement toward total black box checking of content Your suggestions would require implementing a black box checking of content, running on my computer, and not under my control. Calling it "voluntary" in the sales pitch makes it useless, because the person who controls the computer can disable any reports from it. > presumes that the intersection of child porn consumers and users sophisticated enough to disable a scan like the one I'm imagining is very small The size of the intersection doesn't matter, because only a single person needs to write a script that disables the scan. In addition, if a scan requires sophistication to disable, that implies that it is an opt-in scan, and that goes against your sales pitch as "voluntary".

5y ago

anamax 5y ago

> ideally something like an online jury of ones peers, but who don't know you) take a quick glance at the photo, determine it's your kids in the bathtub and not CSAM, and click "It's Fine". How does someone who doesn't know me determine that it's my kids in the bathtub? (The answer can't be "you have to submit other pictures of your kids" because if I can get pictures of random kids in a bathtub, I can probably get other pictures of said kids.)

Dylan16807 5y ago

What a massively invasive system just to find pre-registered images and not prevent abuse at all...