3 ms·

We have to give them something for CSAM, or they'll keep coming at free speech in general using CSAM as cover. I strongly recommend considering the invention o

We have to give them something for CSAM, or they'll keep coming at free speech in general using CSAM as cover. I strongly recommend considering the invention of a sticky, client-side program that scans all images passing through your network interfaces. It is also allowed to send red flagged images to a jury that will be a first hurdle to doing anything: determining it's really a CSAM matter. I've proposed this before, and got shouted down. Partly because its client side and can be theoretically disabled. But I think it can be made as difficult as black box baseband firmware to undermine. I do not believe the argument that consumers are sophisticated enough to disable this scan, if implemented well. We have demonstrated the ability to force-run processes at every level of abstraction for general compute hardware. Our best hope is to implement something that has a reasonable chance of catching actual CSAM without generating false positives and without being exploited to prosecute people deemed problematic for arbitrary reasons. Otherwise we get what is probably happening now, which is the secretive scanning of all messages, prosecution limited only by the cost of parallel construction.

anaganisk 5y ago
Couldnt it be easily broken by masquerading a jpg as a txt file? Or actual people who pass such images use some kind of masking techniques. I will tell you what, any thing can be broken if it’s on software. DRM is broken by design because it failed to stop shit its only a hurdle to actual users.
- javajosh 5y ago
  That doesn't sound like an argument against my proposal. Or, if it is, it's like arguing against using locks because any lock can be picked. Any counter-measure, even the most invasive and draconian, can be foiled by simply doing your CSAM offline, using photocopiers and the postal service. That would be a big improvement, I'd argue.
  - anaganisk 5y ago
    So whats your big improvement then? Locks are there to prevent random joes from entering your house, no one expects a lock to work against thieves that would be foolish because it never stopped em. Your argument is otherwise, you expect your “lock” to work on culprits. Also your offline scanning tech requires an update to hashes all the time, whats stopping any jury/govt from injecting hashes that aren’t CSAM, expecting governments and as an extension judiciary to operate in good faith is more foolish to assume. Im not even talking about breaking into the scanning software, defeating the scan is as easy as not sending them as image simple.
nine_k 5y ago
Two questions: how do we know that the program only scans images, and only exfiltrates CSAM-suspect content? Otherwise looks fine, as long as the traffic is never encrypted.
- javajosh 5y ago
  You hit on the feature that makes it viable: you would always know if an image is flagged, and as what. It doesn't stop your nation state from flagging you as a problem because you're gay, but it also doesn't hide the fact that they're looking for that. I think that's the best we can do right now.
dane-pgp 5y ago
> I think it can be made as difficult as black box baseband firmware to undermine. And once we've set the precedent in law that the government gets to force mandatory unauditable features onto all computing devices, what makes you think they'll stop at image scanning? You're basically saying that no Free and Open Source machine should ever be allowed on the internet again.
- javajosh 5y ago
  If it can't be designed properly, then I withdraw the suggestion, but I think it's possible to design something that cannot hide from you the fact of a detection and the questionable content. That is, if they don't stop at image scanning for CSAM then you'll at least know it, even if you can't stop it. Not perfect, but its something.

anaganisk 5y ago

Couldnt it be easily broken by masquerading a jpg as a txt file? Or actual people who pass such images use some kind of masking techniques. I will tell you what, any thing can be broken if it’s on software. DRM is broken by design because it failed to stop shit its only a hurdle to actual users.

javajosh 5y ago
That doesn't sound like an argument against my proposal. Or, if it is, it's like arguing against using locks because any lock can be picked. Any counter-measure, even the most invasive and draconian, can be foiled by simply doing your CSAM offline, using photocopiers and the postal service. That would be a big improvement, I'd argue.
- anaganisk 5y ago
  So whats your big improvement then? Locks are there to prevent random joes from entering your house, no one expects a lock to work against thieves that would be foolish because it never stopped em. Your argument is otherwise, you expect your “lock” to work on culprits. Also your offline scanning tech requires an update to hashes all the time, whats stopping any jury/govt from injecting hashes that aren’t CSAM, expecting governments and as an extension judiciary to operate in good faith is more foolish to assume. Im not even talking about breaking into the scanning software, defeating the scan is as easy as not sending them as image simple.

nine_k 5y ago

Two questions: how do we know that the program only scans images, and only exfiltrates CSAM-suspect content? Otherwise looks fine, as long as the traffic is never encrypted.

javajosh 5y ago
You hit on the feature that makes it viable: you would always know if an image is flagged, and as what. It doesn't stop your nation state from flagging you as a problem because you're gay, but it also doesn't hide the fact that they're looking for that. I think that's the best we can do right now.

dane-pgp 5y ago

> I think it can be made as difficult as black box baseband firmware to undermine. And once we've set the precedent in law that the government gets to force mandatory unauditable features onto all computing devices, what makes you think they'll stop at image scanning? You're basically saying that no Free and Open Source machine should ever be allowed on the internet again.

javajosh 5y ago
If it can't be designed properly, then I withdraw the suggestion, but I think it's possible to design something that cannot hide from you the fact of a detection and the questionable content. That is, if they don't stop at image scanning for CSAM then you'll at least know it, even if you can't stop it. Not perfect, but its something.