5 ms·

I am not to say you made false claims, but I'm not sure that your connection between what com.apple.mediaanalysisd and the com.apple.snoot API call is fully jus

by csydas 4y ago

I am not to say you made false claims, but I'm not sure that your connection between what com.apple.mediaanalysisd and the com.apple.snoot API call is fully justified or backed by evidence. It is interesting to understand what this call is for and what the mediaanalysisd daemon is actually doing/sending, but just triggering LittleSnitch while browsing local documents I'm not sure is enough to draw a direct connection. Correlation perhaps, but honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. Checking with just activity monitor on the mediaanalysisd process and its network traffic while browsing through pictures, the sent/received data is bytes in size; I'm not in a position to do a proper network capture, but already I question what those few bytes are and if it's really related to my media browsing activities or just background noise. There is a fairly significant amount of received traffic (like close to 200 GiB) compared to the sent traffic (13 GiB), so I'm not quite convinced that this correlates to media scanning. Passing psgrep with mediaanalysisd to lsof shows a lot of fairly normal background processes/daemons like webkit, AppleSupport, the AppStore, etc., so I find myself thinking it's more a general process despite the name, but far more research of actual packet data is needed. The only mistake I think you've made is that I think your conclusion is premature to connect file browsing to this daemon, as it seems to handle a lot of stuff besides the implication that it scans documents or that it's specifically related to CSAM. Basically, more information is needed in my opinion. Edit: Changed "feel" to "think" in 2nd to last text block to correct my own language issue.

sneak 4y ago
> honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. I didn't make that claim, because I have not RE'd mediaanalysisd to know precisely what it's doing. The strings in the binary suggest it does face and animal detection, and processes some sort of "blacklist". As I mentioned, I don't use Photos.app or iCloud so I'm not sure how any of my media would be eligible for analysis. I was literally viewing images in the Finder via spacebar QuickLook (not even in Preview) when it hit the network for the first time. Maybe it's downloading models? Maybe it's sending analytics? Maybe it's sending perceptual hashes? Who knows? I'm hoping that this post causes someone with the time and skills to do an in-depth RE of the binary to take a closer look at precisely what is happening with regards to images that are not eligible for processing in Photos.app or iCloud.
- oneplane 4y ago
  Pretty much everything in UIKit, Cocoa etc. that uses native widgets use background frameworks and services that use things like searchpartyd, mediaanalysisd, knowledged, mds, touristd, and a whole bunch of other D's. That includes searching, previewing (QuickLook) and thumbnails. None of the applications do this themselves 'internally', they just use system frameworks for that. There are at least 1250 private frameworks and 215 shared frameworks, and all of them contain libraries, daemons, XPC services and all of them could be using networking features to act to their design. If you disabled SIP and deleted iCloud and Photos, not much would change. Your media panel widgets would break since they depend on access to the library functions (even if there are empty), but mediaanalysis would still work for all your image renderers. You might think "well that is wasteful, I never use this feature", but you forget that the product was not designed for your personal taste and use case, but for a much broader market. A market where a crapload of money is made every day and a selling point is that there isn't a whole lot to fiddle about with for users.
- csydas 4y ago
  Sneak, I think you're defending your article a little too loosely here. Your article states that Apple is scanning your files and points to network traffic as evidence for this, combining in your summary that Apple scans the data and then tries to reach Apple owned APIs. You spend a non-trivial amount of the article discussing the CSAM plans Apple had, and making it very clear that Apple never said it wouldn't scan and send files/data to law enforcement. Your article builds a case that Apple is exfiltrating data, be it document information, media analysis, etc, outside of the local machine; I find it difficult to accept this was not the intent based on how the article is structure, the bullet points, and the summary. > I was literally viewing images in the Finder via spacebar QuickLook (not even in Preview) when it hit the network for the first time. Yes, this is likely LiveText and other OCR features done live on the M1/M2 models: https://developer.apple.com/documentation/visionkit/enabling_live_text_interactions_with_images https://developer.apple.com/documentation/visionkit/enabling... There is a lot of live processing done with the M1/M2 boards even without iCloud/Photos. I understand you think your article presents an objective and curious item that asks the reader to investigate more, but I and other people in this topic are telling you this is not the way your article is understood and interpreted, and we've pointed out how the other conclusion was reached based on your article. An inquisitive article with a call to action would be just that, as other commenters have already posted: - I see this daemon trying to reach out to Apple APIs - At this time, I was doing this - I have not investigated the binary or network traffic - I find this interesting, but I have not yet drawn a conclusion on it - I invite others to comment on it more If the article was presented like that, you wouldn't have so many comments here stating that they find your conclusion premature and misunderstanding your intention. If your intent is really to call for investigation, I would suggest that you add an addendum section to the article clarifying your goals and purpose, as it seems that overwhelmingly readers are not taking this interpretation.

by csydas 4y ago

sneak 4y ago

> honestly I think before making the claim that Apple is sending specific document information to their servers, it'd be better to get something a bit more concrete. I didn't make that claim, because I have not RE'd mediaanalysisd to know precisely what it's doing. The strings in the binary suggest it does face and animal detection, and processes some sort of "blacklist". As I mentioned, I don't use Photos.app or iCloud so I'm not sure how any of my media would be eligible for analysis. I was literally viewing images in the Finder via spacebar QuickLook (not even in Preview) when it hit the network for the first time. Maybe it's downloading models? Maybe it's sending analytics? Maybe it's sending perceptual hashes? Who knows? I'm hoping that this post causes someone with the time and skills to do an in-depth RE of the binary to take a closer look at precisely what is happening with regards to images that are not eligible for processing in Photos.app or iCloud.

oneplane 4y ago
Pretty much everything in UIKit, Cocoa etc. that uses native widgets use background frameworks and services that use things like searchpartyd, mediaanalysisd, knowledged, mds, touristd, and a whole bunch of other D's. That includes searching, previewing (QuickLook) and thumbnails. None of the applications do this themselves 'internally', they just use system frameworks for that. There are at least 1250 private frameworks and 215 shared frameworks, and all of them contain libraries, daemons, XPC services and all of them could be using networking features to act to their design. If you disabled SIP and deleted iCloud and Photos, not much would change. Your media panel widgets would break since they depend on access to the library functions (even if there are empty), but mediaanalysis would still work for all your image renderers. You might think "well that is wasteful, I never use this feature", but you forget that the product was not designed for your personal taste and use case, but for a much broader market. A market where a crapload of money is made every day and a selling point is that there isn't a whole lot to fiddle about with for users.
csydas 4y ago
Sneak, I think you're defending your article a little too loosely here. Your article states that Apple is scanning your files and points to network traffic as evidence for this, combining in your summary that Apple scans the data and then tries to reach Apple owned APIs. You spend a non-trivial amount of the article discussing the CSAM plans Apple had, and making it very clear that Apple never said it wouldn't scan and send files/data to law enforcement. Your article builds a case that Apple is exfiltrating data, be it document information, media analysis, etc, outside of the local machine; I find it difficult to accept this was not the intent based on how the article is structure, the bullet points, and the summary. > I was literally viewing images in the Finder via spacebar QuickLook (not even in Preview) when it hit the network for the first time. Yes, this is likely LiveText and other OCR features done live on the M1/M2 models: https://developer.apple.com/documentation/visionkit/enabling_live_text_interactions_with_images https://developer.apple.com/documentation/visionkit/enabling... There is a lot of live processing done with the M1/M2 boards even without iCloud/Photos. I understand you think your article presents an objective and curious item that asks the reader to investigate more, but I and other people in this topic are telling you this is not the way your article is understood and interpreted, and we've pointed out how the other conclusion was reached based on your article. An inquisitive article with a call to action would be just that, as other commenters have already posted: - I see this daemon trying to reach out to Apple APIs - At this time, I was doing this - I have not investigated the binary or network traffic - I find this interesting, but I have not yet drawn a conclusion on it - I invite others to comment on it more If the article was presented like that, you wouldn't have so many comments here stating that they find your conclusion premature and misunderstanding your intention. If your intent is really to call for investigation, I would suggest that you add an addendum section to the article clarifying your goals and purpose, as it seems that overwhelmingly readers are not taking this interpretation.