4 ms·

Basic research would have shown this person that mediaanalysisd has been apart of macOS for long before Apple's CSAM local-scanning plan. This is essentially a

Basic research would have shown this person that mediaanalysisd has been apart of macOS for long before Apple's CSAM local-scanning plan. This is essentially a conspiracy theorist post. 1. There is a thing happening I do not know anything about. 2. There is a thing I read about that sounds nefarious to me. 3. Therefor, A is B.

sneak 4y ago
If I made any false claims in the article, please let me know ASAP so I can correct them. I was very careful to report facts only and let the readers draw their own conclusions about what is happening here.
- codehitchhiker 4y ago
  > Apple Has Begun Scanning Your Local Image Files Without Consent You consent when you agree to use their software. The information is encrypted and stays on your device. One of many notices over the years is here: https://www.apple.com/ios/photos/pdf/Photos_Tech_Brief_Sept_2019.pdf https://www.apple.com/ios/photos/pdf/Photos_Tech_Brief_Sept_... And, they've been analyzing your local image files for over a decade for numerous OS purposes. > The media erroneously reported this as Apple reversing course. The article you are quoting (whose author you infer has poor reading comprehension) is from December 2022. CSAM was put on pause in 2021. They have announced as of last month it is no longer being developed. You criticize Lily's ability to understand Apple's statements, and yet: > At the beginning of September 2021, Apple said it would pause the rollout of the feature to “collect input and make improvements before releasing these critically important child safety features.” In other words, a launch was still coming. Now the company says that in response to the feedback and guidance it received, the CSAM-detection tool for iCloud photos is dead. Is this a lack of reading comprehension? Or did you just not read it at all? > Today, Apple scanned my local files and those scanning programs attempted to talk to Apple APIs, even though I don’t use iCloud, Apple Photos, or an Apple ID. > This is your first and only warning: Stock macOS now invades your privacy via the Internet when browing [sic] local files, taking actions that no reasonable person would expect to touch the network, with iCloud and all analytics turned off, no Apple apps launched (this happened in the Finder, via spacebar preview), and no Apple ID input. You have been notified of this new reality. You will receive no further warnings on the topic. You are inferring (and I'm using the term infer to be very charitable) Apple is sending data to its servers based on the media it analyzes. It's clear that packets are coming in the form of GET requests (406B/s) not outbound requests (6B/s). IIRC that API endpoint is for searching to process your input before actually searching your local machine to get Siri suggestions and what not. > Integrate this data and remember it: macOS now contains network-based spyware even with all Apple services disabled. It cannot be disabled via controls within the OS: you must used third party network filtering software (or external devices) to prevent it. I'd call their advertising network-based spyware, but this isn't. And you absolutely can disable these features. I trust you will update the article now.
- etchalon 4y ago
  You didn't report false claims. You reported a bunch of unrelated claims without any technical research, and then pointed your readers to a conclusion that lacked any technical or journalistic merit. It's shallow alarmism.
  - sneak 4y ago
    An entire valid critique, but would you be alarmed if your computer suddenly started making network requests when you were browsing private images in a local directory, having previously opted out of all network services/features? At the very least, it's a bug. At worst, it's covert surveillance.
    - etchalon 4y ago
      Or it's an entirely valid necessity of a feature you do not understand, that's being driven by a system setting you also do not understand. The system could be behaving exactly as it should be, but because you failed to do any research before drawing any conclusions, you've decided there are only two explanations when many more could be possible.
      - sneak 4y ago
        Which system setting?
        oneplane 4y ago
        Nobody here is going to do your homework for you. The Venn diagram of people that can and people that want to know but don't know how to do it is not going to have a lot of overlap.
- DoctorNick 4y ago
  little snitch has the ability to MITM and display the contents of transfers. I'd suggest you use it and amend the post with details.
  - oneplane 4y ago
    Not for urlsessions with pinned keys, especially not on AMFI binaries you can't patch if you're not in development mode.
    - DoctorNick 4y ago
      well, sounds like he has his work cut out for him then.
      - oneplane 4y ago
        If he can't do something like "strings /System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd" I don't think any actual investigation of the binary or traffic is the first step of learning for him to take...
- IMcD23 4y ago
  I see no evidence in your post that mediaanalysisd reaching out to an Apple server is related to CSAM detection. Have you analyzed the traffic?
- hx833001 4y ago
  You know what you did.
- oneplane 4y ago
  > let the readers draw their own conclusions That's not how this works. A system-level background process is not going to be 'concluded upon' by random readers on the internet. The only thing you should have written is: "a process made a connection, but I don't know what the process is for or what the connection is for, and I do not know how to investigate it". Your readers could then conclude a bunch: - You use little snitch - But you don't really know how noisy an OS can be - Noise seems scary to you - But you don't know why - And you don't know how to find out You could have made your position more credible by doing some extremely basic tests, like checking for strings inside the binary, or finding out what frameworks and libraries it is linked to. That's 2 built-in commands you can run as a normal user, with no arguments or ordering to think about. But if you did that, your position wouldn't be what it is.
  - sneak 4y ago
    I have an entire blog post about how noisy macOS is, with pcaps: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20210202/macos-11.2-network-privacy/ I'm not interested in projecting credibility, only disseminating facts for analysis.
    - oneplane 4y ago
      Well, that's not what you did, no matter your intentions. > Apple Has Begun Scanning Your Local Image Files Without Consent Begun? Nope, ancient process and system that has been there for many major releases. Consent? Definitely gave consent, both at the macro and the micro level. You can't actually get up and running or use Finder unless you gave that consent, because it's the first thing that you have to do when you boot up for the first time. So both of your key statements are measurably false, and your blog is riddled with fantasies and propositions that don't have the facts to back them up.
- csydas 4y ago
  I am not to say you made false claims, but I'm not sure that your connection between what com.apple.mediaanalysisd and the com.apple.snoot API call is fully justified or backed by evidence. It is interesting to understand what this call is for and what the mediaanalysisd daemon is actually doing/sending, but just triggering LittleSnitch while browsing local documents I'm not sure is enough to draw a direct connection. Correlation perhaps, but honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. Checking with just activity monitor on the mediaanalysisd process and its network traffic while browsing through pictures, the sent/received data is bytes in size; I'm not in a position to do a proper network capture, but already I question what those few bytes are and if it's really related to my media browsing activities or just background noise. There is a fairly significant amount of received traffic (like close to 200 GiB) compared to the sent traffic (13 GiB), so I'm not quite convinced that this correlates to media scanning. Passing psgrep with mediaanalysisd to lsof shows a lot of fairly normal background processes/daemons like webkit, AppleSupport, the AppStore, etc., so I find myself thinking it's more a general process despite the name, but far more research of actual packet data is needed. The only mistake I think you've made is that I think your conclusion is premature to connect file browsing to this daemon, as it seems to handle a lot of stuff besides the implication that it scans documents or that it's specifically related to CSAM. Basically, more information is needed in my opinion. Edit: Changed "feel" to "think" in 2nd to last text block to correct my own language issue.
  - sneak 4y ago
    > honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. I didn't make that claim, because I have not RE'd mediaanalysisd to know precisely what it's doing. The strings in the binary suggest it does face and animal detection, and processes some sort of "blacklist". As I mentioned, I don't use Photos.app or iCloud so I'm not sure how any of my media would be eligible for analysis. I was literally viewing images in the Finder via spacebar QuickLook (not even in Preview) when it hit the network for the first time. Maybe it's downloading models? Maybe it's sending analytics? Maybe it's sending perceptual hashes? Who knows? I'm hoping that this post causes someone with the time and skills to do an in-depth RE of the binary to take a closer look at precisely what is happening with regards to images that are not eligible for processing in Photos.app or iCloud.
twiss 4y ago
Does the basic research also reveal what information mediaanalysisd is sending to Apple, since when, and why? If so, could you link to it? I can't find much about it. (Also, just because it's existed for a long time doesn't mean it's behavior hasn't changed.)
- etchalon 4y ago
  You can wire up a proxy and watch the traffic if you were so interested. The fact the articles author didn't bother to and report back what they found, means this person didn't even do the bare minimum of technical research before posting an alarmist article. They saw a thing happening they didn't understand and decided to post some nonsense online.
  - twiss 4y ago
    I can't, because I don't have a Mac. I'm interested what Apple is doing because of the wider discussion, though. So if someone else can, I'd be grateful :)
- kstrauser 4y ago
  That’s all true, but I don’t see any evidence that it did change. There are any number of background processes that might have changed. There’s not a story unless it appears that one did.
  - twiss 4y ago
    The post provides one data point that it did: Little Snitch started reporting traffic from mediaanalysisd. It's not very extensive evidence, but not quite none, either.
    - etchalon 4y ago
      It's as good as none.

sneak 4y ago

If I made any false claims in the article, please let me know ASAP so I can correct them. I was very careful to report facts only and let the readers draw their own conclusions about what is happening here.

codehitchhiker 4y ago
> Apple Has Begun Scanning Your Local Image Files Without Consent You consent when you agree to use their software. The information is encrypted and stays on your device. One of many notices over the years is here: https://www.apple.com/ios/photos/pdf/Photos_Tech_Brief_Sept_2019.pdf https://www.apple.com/ios/photos/pdf/Photos_Tech_Brief_Sept_... And, they've been analyzing your local image files for over a decade for numerous OS purposes. > The media erroneously reported this as Apple reversing course. The article you are quoting (whose author you infer has poor reading comprehension) is from December 2022. CSAM was put on pause in 2021. They have announced as of last month it is no longer being developed. You criticize Lily's ability to understand Apple's statements, and yet: > At the beginning of September 2021, Apple said it would pause the rollout of the feature to “collect input and make improvements before releasing these critically important child safety features.” In other words, a launch was still coming. Now the company says that in response to the feedback and guidance it received, the CSAM-detection tool for iCloud photos is dead. Is this a lack of reading comprehension? Or did you just not read it at all? > Today, Apple scanned my local files and those scanning programs attempted to talk to Apple APIs, even though I don’t use iCloud, Apple Photos, or an Apple ID. > This is your first and only warning: Stock macOS now invades your privacy via the Internet when browing [sic] local files, taking actions that no reasonable person would expect to touch the network, with iCloud and all analytics turned off, no Apple apps launched (this happened in the Finder, via spacebar preview), and no Apple ID input. You have been notified of this new reality. You will receive no further warnings on the topic. You are inferring (and I'm using the term infer to be very charitable) Apple is sending data to its servers based on the media it analyzes. It's clear that packets are coming in the form of GET requests (406B/s) not outbound requests (6B/s). IIRC that API endpoint is for searching to process your input before actually searching your local machine to get Siri suggestions and what not. > Integrate this data and remember it: macOS now contains network-based spyware even with all Apple services disabled. It cannot be disabled via controls within the OS: you must used third party network filtering software (or external devices) to prevent it. I'd call their advertising network-based spyware, but this isn't. And you absolutely can disable these features. I trust you will update the article now.
etchalon 4y ago
You didn't report false claims. You reported a bunch of unrelated claims without any technical research, and then pointed your readers to a conclusion that lacked any technical or journalistic merit. It's shallow alarmism.
- sneak 4y ago
  An entire valid critique, but would you be alarmed if your computer suddenly started making network requests when you were browsing private images in a local directory, having previously opted out of all network services/features? At the very least, it's a bug. At worst, it's covert surveillance.
  - etchalon 4y ago
    Or it's an entirely valid necessity of a feature you do not understand, that's being driven by a system setting you also do not understand. The system could be behaving exactly as it should be, but because you failed to do any research before drawing any conclusions, you've decided there are only two explanations when many more could be possible.
    - sneak 4y ago
      Which system setting?
      - oneplane 4y ago
        Nobody here is going to do your homework for you. The Venn diagram of people that can and people that want to know but don't know how to do it is not going to have a lot of overlap.
DoctorNick 4y ago
little snitch has the ability to MITM and display the contents of transfers. I'd suggest you use it and amend the post with details.
- oneplane 4y ago
  Not for urlsessions with pinned keys, especially not on AMFI binaries you can't patch if you're not in development mode.
  - DoctorNick 4y ago
    well, sounds like he has his work cut out for him then.
    - oneplane 4y ago
      If he can't do something like "strings /System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd" I don't think any actual investigation of the binary or traffic is the first step of learning for him to take...
IMcD23 4y ago
I see no evidence in your post that mediaanalysisd reaching out to an Apple server is related to CSAM detection. Have you analyzed the traffic?
hx833001 4y ago
You know what you did.
oneplane 4y ago
> let the readers draw their own conclusions That's not how this works. A system-level background process is not going to be 'concluded upon' by random readers on the internet. The only thing you should have written is: "a process made a connection, but I don't know what the process is for or what the connection is for, and I do not know how to investigate it". Your readers could then conclude a bunch: - You use little snitch - But you don't really know how noisy an OS can be - Noise seems scary to you - But you don't know why - And you don't know how to find out You could have made your position more credible by doing some extremely basic tests, like checking for strings inside the binary, or finding out what frameworks and libraries it is linked to. That's 2 built-in commands you can run as a normal user, with no arguments or ordering to think about. But if you did that, your position wouldn't be what it is.
- sneak 4y ago
  I have an entire blog post about how noisy macOS is, with pcaps: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20210202/macos-11.2-network-privacy/ I'm not interested in projecting credibility, only disseminating facts for analysis.
  - oneplane 4y ago
    Well, that's not what you did, no matter your intentions. > Apple Has Begun Scanning Your Local Image Files Without Consent Begun? Nope, ancient process and system that has been there for many major releases. Consent? Definitely gave consent, both at the macro and the micro level. You can't actually get up and running or use Finder unless you gave that consent, because it's the first thing that you have to do when you boot up for the first time. So both of your key statements are measurably false, and your blog is riddled with fantasies and propositions that don't have the facts to back them up.
csydas 4y ago
I am not to say you made false claims, but I'm not sure that your connection between what com.apple.mediaanalysisd and the com.apple.snoot API call is fully justified or backed by evidence. It is interesting to understand what this call is for and what the mediaanalysisd daemon is actually doing/sending, but just triggering LittleSnitch while browsing local documents I'm not sure is enough to draw a direct connection. Correlation perhaps, but honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. Checking with just activity monitor on the mediaanalysisd process and its network traffic while browsing through pictures, the sent/received data is bytes in size; I'm not in a position to do a proper network capture, but already I question what those few bytes are and if it's really related to my media browsing activities or just background noise. There is a fairly significant amount of received traffic (like close to 200 GiB) compared to the sent traffic (13 GiB), so I'm not quite convinced that this correlates to media scanning. Passing psgrep with mediaanalysisd to lsof shows a lot of fairly normal background processes/daemons like webkit, AppleSupport, the AppStore, etc., so I find myself thinking it's more a general process despite the name, but far more research of actual packet data is needed. The only mistake I think you've made is that I think your conclusion is premature to connect file browsing to this daemon, as it seems to handle a lot of stuff besides the implication that it scans documents or that it's specifically related to CSAM. Basically, more information is needed in my opinion. Edit: Changed "feel" to "think" in 2nd to last text block to correct my own language issue.
- sneak 4y ago
  > honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. I didn't make that claim, because I have not RE'd mediaanalysisd to know precisely what it's doing. The strings in the binary suggest it does face and animal detection, and processes some sort of "blacklist". As I mentioned, I don't use Photos.app or iCloud so I'm not sure how any of my media would be eligible for analysis. I was literally viewing images in the Finder via spacebar QuickLook (not even in Preview) when it hit the network for the first time. Maybe it's downloading models? Maybe it's sending analytics? Maybe it's sending perceptual hashes? Who knows? I'm hoping that this post causes someone with the time and skills to do an in-depth RE of the binary to take a closer look at precisely what is happening with regards to images that are not eligible for processing in Photos.app or iCloud.

twiss 4y ago

Does the basic research also reveal what information mediaanalysisd is sending to Apple, since when, and why? If so, could you link to it? I can't find much about it. (Also, just because it's existed for a long time doesn't mean it's behavior hasn't changed.)

etchalon 4y ago
You can wire up a proxy and watch the traffic if you were so interested. The fact the articles author didn't bother to and report back what they found, means this person didn't even do the bare minimum of technical research before posting an alarmist article. They saw a thing happening they didn't understand and decided to post some nonsense online.
- twiss 4y ago
  I can't, because I don't have a Mac. I'm interested what Apple is doing because of the wider discussion, though. So if someone else can, I'd be grateful :)
kstrauser 4y ago
That’s all true, but I don’t see any evidence that it did change. There are any number of background processes that might have changed. There’s not a story unless it appears that one did.
- twiss 4y ago
  The post provides one data point that it did: Little Snitch started reporting traffic from mediaanalysisd. It's not very extensive evidence, but not quite none, either.
  - etchalon 4y ago
    It's as good as none.