13 ms·

Is Apple checking images we view in the Finder?

245 points by tagawa 4y ago

golem14 4y ago
Maybe today. What does it matter when apple can change their policy anytime the feel like it? Maybe they can dynamically turn things on and off.
tagawa 4y ago
Spoiler alert: “There is no evidence that local images on a Mac have identifiers computed and uploaded to Apple’s servers when viewed in Finder windows.”
- jjcon 4y ago
  For the record I don’t believe Apple is collecting that info - having said that I think the biggest issue with Apple is that it is not possible to fully audit and determine what they collect and what they don’t. Just because they aren’t constantly sending hashes over the internet after viewing each photo in finder doesn’t mean that similar data isn’t collected at all over the many encrypted connections apple maintains with their servers and Mac computers. It would be colossally stupid for them to betray user trust in that way as it would almost certainly come out eventually, but that doesn’t change the trust problem they ultimately do have.
  - amelius 4y ago
    It's freaking annoying that you can't use an Apple device without being connected to Apple. There should be a law against that sort of thing, for hardware that you fully paid for.
    - EMIRELADERO 4y ago
      While not specifically that, the EU's Digital Markets Act is moving things in that direction. I recommend reading the full text of the legislation, it has many gems.
    - whiddershins 4y ago
      You can wipe it and install Linux and use the hardware you paid for unencumbered. So do you mean use the software you paid for? (Fair) Or am I missing a nuance. Edit: Or are you referring to iDevices.
      - amelius 4y ago
        Running Linux on it is not the solution, as there is no documentation. Volunteers have been reverse engineering the GPU, but they still don't know whether their assumptions are all correct. Also, is the Linux support actually official? Considering the above, I think not. I can't vote with my wallet for a company that has no clear map for the future, for my particular usecases. Yes, iDevices are another problem. And yes, paying for the software when you use only the hardware is a problem too. Too many problems with this company. I honestly can't understand why so many other hackers are happy being tethered and parent-controlled by Apple.
        cassianoleal 4y ago
        > I honestly can't understand why so many other hackers are happy being tethered and parent-controlled by Apple. Obviously it varies from person to person. Some just don't care about this at all and/or don't consider it an issue. Some are just really used to it, or invested in the platforms, and don't want to waste time moving. Some will just find much worse experiences for their taste anywhere else. There are likely other personas in this story, these are just off the top of my head.
        shanebellone 4y ago
        I haven't used Apple in 5-8 years. I prefer to build my desktops and don't use my phone much, so Android is sufficient. Frankly, I do not understand the disdain for Apple. They built their stack. That should be admired. Also, it's one ecosystem in the market. Don't like it? Buy something else.
        EricE 4y ago
    - 2OEH8eoCRo0 4y ago
      I agree, that's why I don't buy them. All of my computers are 9+ years old and run fully up to date Linux or Windows.
      - frankfrankfrank 4y ago
        I’m not sure what would make you think that Windows is even in the slightest better. In fact it is proven that not only is Microsoft deeply in bed with the whole US Government, but the amount of vulnerabilities and flaws and outright back doors that have been publicly exposed in Windows is wildly larger. I don’t even understand this immense focus on criticizing Apple, as valid as it is, when people use Android and Windows and Google services that are all shown as clear hangar door sized vulnerabilities. It really kind of boggles my mind. Apple is constantly being out under pressure by the government and is constantly pushing increasing security and privacy features, as imperfect as they may be, but that is in comparison to Windows and Android, folks.
        2OEH8eoCRo0 4y ago
        I use Linux but have a barebones Windows 10 install for one stupid stressful game that doesn't work on Linux due to anticheat. I audibly groan when rebooting to Windows to play. With that said I can still use Windows without a Microsoft account.
        daf203723087 4y ago
        > With that said I can still use Windows without a Microsoft account. Only because you are a power-user and know the magic trick to perform when installing Windows to avoid signing in with a Microsoft account.
        CharlesW 4y ago
        > With that said I can still use Windows without a Microsoft account. It sounds like you may not realize that you have never needed an Apple account (i.e. an Apple ID, which might call an "iCloud account") to use macOS. No magic tricks are required, although some Apple services will naturally not be avaiable.
    - themitigating 4y ago
      I don't think more government regulation for such a specific reason is a good idea. Just don't buy their products.
      - alwayslikethis 4y ago
        At some point this "voting with your wallet" argument gets ridiculous. How realistic is going through life without one of these slaveware devices? (defining slaveware as hardware or software that treats you as a slave to the corporation that made it) Most people are coerced to using it, not even knowing the difference, forcing you to use the slaveware as well.
      - oneplane 4y ago
        Do you really think the general consumer knows about any technical details of the products they buy, and if they did, they would care enough to chose the less-comfortable option for no perceived gain? This almost never works, and I think you know that.
        themitigating 4y ago
        Do you really think the general consumer knows any medical details of the vaccines they buy? Should we regulate misinformation?
        LarryMullins 4y ago
        We regulate vaccines, don't we? If you're so opposed to government regulation, vaccines are a very strange example to bring up.
    - dotancohen 4y ago
      > There should be a law against that sort of thing, for hardware that you fully paid for. Why? That sounds like exactly the type of issue that the market will fix, by buying from a different vendor.
      - oneplane 4y ago
        It seems the market isn't what you tink it is. At the same time, people also don't understand that the issue isn't what they think it is. There is a vocal minority on most of these things: - Powerusers and "learnt just enough to be dangerous" users complain about products not being targeted towards their wishes - Privacy alarmists don't like what they can't control - Commercial interests don't like having to pay for things, but do like getting paid for their own things Technically all correct, but in practise this is nearly all in the same bucket as fastfood, sugar, air pollution etc. It's something that affects everyone, but it's much easier to deny it, ignore it, and just go with the nice, easy, comfortable, and profitable paths.
        dotancohen 4y ago
        > It seems the market isn't what you tink it is. Then what is it? I think that the market is an opportunity for companies to compete on features, price, service, and quality. Is that incorrect? If Apple is not competing on features, then shouldn't the market provide an alternative company that does? Specifically, Apple requires a network connection to its servers to used basic functionality yet consumers do not like this. Other companies provide devices that do not require a network connection to its servers to used basic functionality, though possibly at a higher price (doubtful) or lower quality, or worse service. But the opportunity does exist. I'm happy to hear where either my understanding is wrong, or where the market is failing.
        oneplane 4y ago
        Just look around you, do you see any critical mass on both the vendor or consumer side that does something the way you describe it? Every time someone comes up with some confident theory on markets or how things should be, or how bad the things are as they currently are, they forget that the reality is 'the market' (whatever their definition happens to be at that time) did not, in fact, change due to either supply or demand. So when you were to say "the market demands offline devices, and the big companies are failing because they don't deliver that", you're either talking about a theoretical market, or about a different market, but not about the mass consumer electronics market. Because the big companies aren't failing, and regardless of the demand, no significant portion seems to be supplied.
    - Someone 4y ago
      > There should be a law against that sort of thing, for hardware that you fully paid for. So, if Apple were to say you didn’t fully pay for the hardware, it would be OK?
    - EricE 4y ago
      You can. It's just if you do disconnect from Apple entirely, then certain features like Visual Lookups break - unsurprisingly. Not sure why there is this persistent myth that you can only use Apple tech if "connected" to Apple.
  - marcosdumay 4y ago
    > It would be colossally stupid for them to betray user trust in that way Yes. Unless, of course somebody is pointing a gun to their heads and forcing them, like the US government was already caught doing to other companies.
    - slenk 4y ago
      Interesting. Do you have any more info I could read regarding that.
      - martin_a 4y ago
        Ever heard about the CLOUD Act? Or the PATRIOT Act?
    - NineStarPoint 4y ago
      I can think of lots of examples where the US gov secretly forced companies to hand over data they were already collecting, but not really any situations where the gov secretly forced companies to start collecting data they weren’t already. Are there examples of the second?
      - colanderman 4y ago
        Does this count? https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
  - 1vuio0pswjnm7 4y ago
    "For the record I don't believe Apple is collecting that info - having said that I think the biggest issue with Apple is that it is not possible to fully audit and determine what they collect and what they don't." This begs the question why is it not possible. I monitor the traffic on the computers I own which means I have sometimes to decrypt traffic from applications and then re-encryot before sending from the loopback to the local network I own and then over the wire onto "the internet". I like to know what data applications are sending or trying to send. I like to have control over it. That's not unreasonable in the slightest. Yet, in the "tech" company model of computer network use, the computer owner is discouraged, e.g., scary browser warnings, SSL errors, connection failures, etc., from placing any trust in themselves. Instead it advocates, if not effectvely mandates, placing trust (and fees, i.e., for "domain names") in some other entity, e.g., Apple, other "Certificate Authorities", etc. The mere act of questioning this model is often attacked by "tech" workers commenting online. Watch it happen in the replies. Under this model, it is as if the the computer and local network owner does not also own the traffic. Who owns the computer. Who owns the local network. Who own the data. Who should be allowed to view it and control it. If anything, one would think the computer and network owner should be allowed to prevent any third party, including Apple, if they so choose, from initiating remote connections and sending data from the computer owner's computer. Even after purchase Apple believes it is entitled to collect data from someone else's computer, over someone else's network. And it also believes no computer purchaser ever has an interest in seeing what data is being collected, by monitoring the traffic, let alone an interest in preventing these connections. There is no option provided to globally disable all phoning home to Apple, to indicate "No, thank you." It was not always like this, folks. I owned older Apple computers that never made such assumptions. The computer belonged to the purchaser. Generally, firewalls were not used to block software pre-installed on the computer by Apple. The so-called "tech industry" has moved the needle and tried to normalise what is IMHO an entirely different scenario.
    - oneplane 4y ago
      > I like to know what data applications are sending or trying to send Good luck with that. Unless you are running a Commodore 64 it is unlikely that a single person can understand, inspect and make decisions on modern operating systems or even individual applications. There was a small window in which you had the option to use your computer as a 'digital typewriter' and 'sometimes send a fax', but expected and supplied functionality this day and age relies on many small components being heavily interconnected, much in the same way that social circles are interconnected, social networks (the digital variant) are based on critical mass (not technical prowess, legal status or privacy) and the amount of people that have narrow/well-defined use cases for their computers are at an all-time low making them less and less significant to cater to. If you had a Apple computer with 10.3 or newer, this was the norm. If you had macOS 9 with iTools, it was the norm as well (for a bit until it got dropped in favour of MobileMe). The old times weren't better, just different (and much less feature-rich). Great for a few power users, bad for everyone else.
- cookie_monsta 4y ago
  So, Betteridge's Law? https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headlines https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headline...
  - b3morales 4y ago
    Sort of, but this article seems to be specifically a response to a recent blog post that said that the answer was "Yes": https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...
    - IndySun 4y ago
      Thank you. I much prefer Sneaks stance on Apple than eclectic light's. Both post enough useful public information to remind people that Apple are not as different to other giants in underhand software tech shenanigans. Eclectic often make us aware of Apple updating software without permission, which is bad enough, and commonly known on this forum. But Sneak will present reasons why Apple users should not become complacent, and for that I am grateful.
      - acdha 4y ago
        The problem is that Sneak tends towards conspiratorial thinking so you need to read posts through the lens of separating what’s factually established from what hypothetically could be done in the future.
        IndySun 4y ago
        I do, as everyone should, filter. I find his writing straightforward, moreso than the twisted language of an average Apple 'event'. Conspiratorial may sound sensational to some, but saying one thing and doing another is apt and proportional for walled garden tech. It's a wide net cast. That's all.
        acdha 4y ago
- runjake 4y ago
  Caveat: "Images viewed in apps supporting VLU have neural hashes computed, and those are uploaded to Apple’s servers to perform look up and return its results to the user, as previously detailed[1]." (but not for CASM reasons) 1. https://eclecticlight.co/2022/03/25/how-visual-look-up-works-in-detail-2-object-recognition-and-live-text/ https://eclecticlight.co/2022/03/25/how-visual-look-up-works...
  - btown 4y ago
    A bit hard to believe that VLU's NeuralHashes aren't also passed through CSAM detection, when NeuralHashes were first announced to the world in the context of CSAM detection: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... That said, to reiterate the OP, there's no evidence that VLU executes when using Finder or QuickLook alone.
    - mftb 4y ago
      Are you sure? Because in a prior article on the same source your parent linked it would appear that it is being used with QuickLook[0]. "While VLU is taking place, the image being looked up is opened in the floating window of a QuickLook preview." [0]https://eclecticlight.co/2022/03/23/how-visual-look-up-works-in-detail-1-paintings-on-intel-and-m1-macs/ https://eclecticlight.co/2022/03/23/how-visual-look-up-works...
      - btown 4y ago
        Hmm, there is some ambiguity in the author's writing style. I interpreted what you quoted above as "if you are in Safari.app or Preview.app and activate VLU explicitly, it displays the image in a QuickLook window." The author does say in https://eclecticlight.co/2023/01/18/is-apple-checking-images-we-view-in-the-finder/ https://eclecticlight.co/2023/01/18/is-apple-checking-images... that: > Although the original description given was ‘Finder browsing’, for some that might include the display of images as QuickLook Previews, by selecting the image and pressing the Spacebar... [The process triggered from this] is consistent with the briefer task used in Live Text, and quite different from VLU. There is thus no evidence of the generation of neural hashes or any search query by PegasusKit typical of the later stages of VLU... > Local images that are viewed in QuickLook Preview undergo normal analysis for Live Text, and text recognition where possible, but that doesn’t generate identifiers that could be uploaded to Apple’s servers.
- cycomanic 4y ago
  I don't know how someone can make such a detailed analysis and apparently not understand the limitations of the same analysis. How can such a broad statement be posted otherwise? There could be all sorts of explanations why a connection might not have shown up in their analysis, rate limiting, batch upload, regional settings. It would have been much better to say: "in my tests I could observe any evidence..." or something similar.
- poszlem 4y ago
  The phrase 'there is no evidence' can be interpreted in two ways, one being that it is highly likely but unproven, and the other being that it has been disproven and should not be believed. I'm afraid we are still in the first version territory given what we know about big tech and Apple's recent behaviour.
ok123456 4y ago
It's wild that you need a firewall just to stop OS features from phoning home every file you preview on your computer.
- gjsman-1000 4y ago
  Or just turn off "Siri Suggestions" in System Settings as stated in the article.
  - c22 4y ago
    I'd probably stick with the firewall just to be safe, thorough, and future-proofed...
    - gjsman-1000 4y ago
      Well... macOS is hardly the worst IoT offender. Roku is unbelievable. ;) Many good reasons to set up a Pi-Hole...
    - Xylakant 4y ago
      You’d need a network level firewall for that - the OS can circumvent any firewall you run on your computer. That would imply that you’re unprotected once you leave your home network. The firewall would also need to inspect all network traffic, including TLS secured connections.
      - deleted 4y ago
        [deleted]
    - VWWHFSfQ 4y ago
      Apple allows itself to bypass the OS firewall so you will need something at the network level.
      - sundvor 4y ago
        .. on every single network you connect your computer to. Maybe there is such a thing as a portable battery powered wireless travel router with proper firewall rules, that can also do VPN etc. Must admit that's something I never looked into.
ramesh31 4y ago
This ignores the possibility that the scan results could be collected and uploaded at a later time, possibly obfuscated within the payload of some other benign process. I fully accept that the sum of engineering and thought by Apple is much smarter than either myself or the average security researcher, and in an adversarial situation such as this, it's far from an impossible scenario. Ultimately, with a closed source OS, we will never really know more than what Apple wants us to know.
- djur 4y ago
  > scan results could be collected and uploaded at a later time The images could also be analyzed and uploaded by software installed remotely on your computer overnight. If you actually consider yourself to be in an "adversarial" relationship with Apple you should not use their products -- they have uncountable opportunities to attack you.
  - deleted 4y ago
    [deleted]
- duxup 4y ago
  Isn’t that “possible” for any computer or device connected to the internet? I feel like “possible” is doing a lot of work here that applies everywhere.
hbarka 4y ago
I recognize the author’s use of Scapple for the flowchart diagram. One of my favorite visual mapping apps appropriated from the writing, not techie, community.
- gernb 4y ago
  I read that as some creative way to use Scrapple for diagrams and went to check out what it was. Imagine my disappointment that it was just some poorly named software and not actually diagrams made from scrapple https://en.m.wikipedia.org/wiki/Scrapple https://en.m.wikipedia.org/wiki/Scrapple
  - hbarka 4y ago
    Yup, it’s Scapple unlike Scrapple. A strange word without history. Let me add a plug for them (Literature and Latte): https://www.literatureandlatte.com/scapple/overview https://www.literatureandlatte.com/scapple/overview They also have another amazing app called Scrivener, made for writers and novelists, but can hold its own against other note-taking apps.
jsz0 4y ago
Probably untrue but the general trend of Apple throwing in the towel on privacy has made me start seriously thinking about the logistics of moving away from macOS in the near future. I know it's going to be super unpleasant because I've been a 20+ year macOS snob and it's an integral part of how I get any work done. Making a reluctant change is so difficult. I almost hope Apple makes some terribly egregious changes to macOS that will make it easier for me to cut it loose and move on.
- deleted 4y ago
  [deleted]
- indymike 4y ago
  I've unplugged as much as I can from both Windows and MacOS. I still have to carry a Mac because of Xcode (and mobile development), Affinity (for design) and from time to time, MS Office (usually to deal with some ancient VBA code). The daily driver is just an LG Gram with Kubuntu, and here's the difference: Command line: Linux wins by a mile. GNU gettext has better tab completion (i.e. it will complete parameters and paths). If you work with Linux servers, it's nice to have the same directory structure... and while brew is nothing short of amazing, package management on Linux (deb, rpm, pacman, etc...) is still the best. Design: A lot of tools have moved to the cloud (i.e. Figma and Canva are getting better) but pro grade design software like Affinity Designer (or Adobe stuff) is still the best, especially if print shops are involved. If Serif ports Affinity to Linux, I will buy it for every machine at my company just to say thanks. Video: Davinci and OSB run extremely well on Linux so life is good :-) Development: Honestly everything is better on Linux... but no Xcode, which is required to distribute to the App Store. Xcode is a nice IDE, but most of the work I do is in JetBrains IDE (GoLand, PyCharm, WebStorm... and occasionally C Lion). On the hardware front, Apple still makes great hardware, but some of the PC manufacturers are making great machines, too (LG, Lenovo, Dell). I'm particularly happy with LG's Gram 17" which has a giant screen and is an ounce or so heavier than a 13" MacBook Air. The M1 and M2 are fast, but a modern i7 or better is plenty fast and you can get one with 32GB for cheap.
- tomxor 4y ago
  Baby steps... maybe start with dual booting, or a VM, over time you get more and more comfortable as you find the bits you need on Linux or whatever. You will probably never find a replacement for everything, but eventually you get to a threshold where the "Apple Hates Me" vibes > "Not quite everything I want", then you have somewhere to go when you flip the table... You will probably still hate it initially, but the nice thing is that you can work on it, making it into what you want, and unlike with Apple or MS you can make progress... it will stay how you put it, because the authors of the software are not working against you. i.e it gets more comfortable over time, and less of a battle over time. Admittedly how easy this is, is highly subjective, e.g if you are a media person then it's going to be painful whatever platform you head to (although I hear audio and video editing alternatives are getting better).
deleted 4y ago
[deleted]
zwilliamson 4y ago
Does anyone have a list of Apple urls that we can block via something like pi hole? On a side note, I'm actively evaluating options to replace my aging MacBook. Anyone have a System76 laptop?
- oneplane 4y ago
  Apple does: https://support.apple.com/en-gb/HT210060 https://support.apple.com/en-gb/HT210060 But as others have written: this won't result in what you think it results in.
- int_19h 4y ago
  If you're looking for a Linux laptop specifically, take a look at StarLabs. https://us.starlabs.systems/ https://us.starlabs.systems/
  - dustyharddrive 4y ago
    How’s the build quality?
    - int_19h 4y ago
      I have StarLite and I like it. One of the reasons why I got it was because System76 stuff seemed to have more complaints on average, although it's hard to say to what extent this is the consequence of them being the more well-known brand. Star Labs also has considerable lead time for new orders - assume a few months.
gockflaps 4y ago
It's refreshing to see someone actually take the time to do some proper analysis on this, rather than simply assuming that Apple are up to no good and getting angry about it based on nothing. Nice work by the author, and a well-explained writeup.
etchalon 4y ago
A great rebuttal and investigation into a topic that was raised by a shallow alarmist last week.
titzer 4y ago
It's beginning to look like it wasn't a great move to become so dependent on so much closed source software. "It's open source" they cry. Yeah, system level stuff, just with some closed-source barnacles attached that do god knows what, stealthily, unaccountably, and yet brazen to a terrifying degree. "Trust us". Hmmm.
squarefoot 4y ago
Broadly speaking, if something is closed source and connected, it phones home. Whether it can collect sensitive private data about the user is just a matter of when. The sooner common users realize that, the safer they can be in the future. Unfortunately, spying on users is a well paid business, therefore even without involving 3 letter government agencies and/or conspiracy theories, we should expect every hardware/software manufacturer to attempt to profit from that, if not because pretty much everyone else in the field is doing the same already.
- deleted 4y ago
  [deleted]
alin23 4y ago
There's also a follow up to that with more findings here: https://eclecticlight.co/2023/01/20/demonstrating-causal-connections-using-the-log/ https://eclecticlight.co/2023/01/20/demonstrating-causal-con...
simonCGN 4y ago
I suppose you should do it the other way round: there is a rumour, you see if it is true rather than assuming it is true and try to find evidence if it is true.
- bboygravity 4y ago
  What if there's no way to find out if it's true?
  - yreg 4y ago
    Then assume it is true when making security decisions, but don't pretend it is true when talking about it in discussions. (imo.)
cyanydeez 4y ago
If apples not building an AI behind each of their users, sell your stock now.
User23 4y ago
If you upload your data to a server that server’s owners can do whatever they want with it. How do people still not get this?
- yreg 4y ago
  This article is not about people uploading data to a server intentionally, so I don't see the connection. Who are the people who 'still don't get this'?
- josephcsible 4y ago
  Distinguish between choosing to upload your data to a server vs. working with data on your local hard drive without air-gapping your computer first.
  - User23 4y ago
    What’s there to distinguish? You’re knowingly using a program that openly advertises that it uploads your data.
lamontcg 4y ago
What happens if we just delete mediaanalysisd? I really don't need visual search algorithms using Apple's cloud servers.
- CharlesW 4y ago
  You can also just turn off Siri Suggestions: https://eclecticlight.co/2022/04/08/how-to-enable-use-and-fix-visual-look-up/ https://eclecticlight.co/2022/04/08/how-to-enable-use-and-fi...
JayGuerette 4y ago
Apple isn't creating neural hashes for CSAM detection, as they'd have to be in possession of source material to create them, so they're getting them from someone else. Since it's indistinguishable in it's hash form, when the supplier becomes interested in looking for something else, nobody will ever know.
- yreg 4y ago
  >so they're getting them from someone else Is there any evidence they even do neural hash CSAM detection?
- echelon 4y ago
  Do not let Apple off the hook. This must be removed. This functionality will be used in other global jurisdictions to clamp down on freedom. In a world where we cede more control and increasingly subjugate ourselves, it's only a matter of time before it's used against us too. Say no to monitoring.
  - brookst 4y ago
    So the thing the article concludes isn’t being done, must be removed?
    - echelon 4y ago
      Maybe that's the case. We should be vigilant and treat the concern with utmost seriousness. Once upon a time, Apple announced they would do this. We can't ever let them.
    - nostromo 4y ago
      The article concludes that there isn't evidence it's being done -- which is different. Apple should not be trusted without evidence. We should be able to verify what our devices are sending to Apple, Google and others.
  - onethought 4y ago
    But they aren’t monitoring. And a hash doesn’t help you monitor unless you’ve got a hash of another image like CSAM. And you can turn this off if you want. Honestly I know everyone thinks that everything is a slippery slope to death camps. But sometimes it’s just a cool helpful feature.
ChrisMarshallNY 4y ago
> Basing claims on the inference that two events might be connected, without understanding the nature of either, is reckless if not malicious. It can easily happen, though. I did it yesterday, with a bank, concerning a credit card number that had been purloined. It was unwise, and reckless, and I ended up owning it, and apologizing (plus, I learned about a trigger that I need to watch out for). That said, just because something "easily happens," does not make it OK. We can "easily" get homicidally angry, and it would be A Bad Thing, if we acted on our impulses. A mark of my personal maturity, is grounding these impulses, before they make it to the outside. When I fail (like yesterday), I get embarrassed.
deleted 4y ago
[deleted]
nbzso 4y ago
After CSAM case I lost trust on any big corporation, the trend for digital control and spying is publicly announced by governments. The global planners in Davos are saying it clearly. So, when the option to run Little Snitch is removed from the macOS, this platform will die for me. I had a hard gripe with Apple since 2015, sadly the UX design team needed to work with Sketch. After CSAM, all developers in the office use Manjaro. We use macs only for the design related workflows. Nowadays, we are lucky that Figma is working in the browser and the switch for the designers will be less hard. On a smartphone front, I reduced my usage to banking apps and phone calls. If I have to take a photo, I use a camera, RX100 or Leica with real lens.
- kalleboo 4y ago
  > Nowadays, we are lucky that Figma is working in the browser and the switch for the designers will be less hard How is storing all your files in the cloud a solution to worries about local image scanning?
  - nbzso 4y ago
    1. Work related files. 2. Collaboration process. 3. There is no alternative for Figma at the moment. 4. Penpot.app is something to look for. They are open source and have an option to run the software on your own cloud/server. But they are not the industry standard, and the tool is without the extensive plugin community of Figma.
spritefs 4y ago
I see a lot of people talking about firewalling in this thread... Apple owns the whole IP range 17.X.X.X, so you can just put the below line in /etc/pf.conf to block all talk with those IPs block drop from any to 17.0.0.0/8 Also for an additional layer of protection, you can add these domains to the hosts file: https://gitlab.com/intr0/AppleBlock/-/blob/master/AppleBlock.txt https://gitlab.com/intr0/AppleBlock/-/blob/master/AppleBlock... Also I see a lot of people trying to defend apple in this thread. Imo life is too short to defend a corporation this large (unless you have a financial incentive to maintain trust in it, obviously)

245 points by tagawa 4y ago

Maybe today. What does it matter when apple can change their policy anytime the feel like it? Maybe they can dynamically turn things on and off.

tagawa 4y ago

Spoiler alert: “There is no evidence that local images on a Mac have identifiers computed and uploaded to Apple’s servers when viewed in Finder windows.”

jjcon 4y ago
For the record I don’t believe Apple is collecting that info - having said that I think the biggest issue with Apple is that it is not possible to fully audit and determine what they collect and what they don’t. Just because they aren’t constantly sending hashes over the internet after viewing each photo in finder doesn’t mean that similar data isn’t collected at all over the many encrypted connections apple maintains with their servers and Mac computers. It would be colossally stupid for them to betray user trust in that way as it would almost certainly come out eventually, but that doesn’t change the trust problem they ultimately do have.
- amelius 4y ago
  It's freaking annoying that you can't use an Apple device without being connected to Apple. There should be a law against that sort of thing, for hardware that you fully paid for.
  - EMIRELADERO 4y ago
    While not specifically that, the EU's Digital Markets Act is moving things in that direction. I recommend reading the full text of the legislation, it has many gems.
  - whiddershins 4y ago
    You can wipe it and install Linux and use the hardware you paid for unencumbered. So do you mean use the software you paid for? (Fair) Or am I missing a nuance. Edit: Or are you referring to iDevices.
    - amelius 4y ago
      Running Linux on it is not the solution, as there is no documentation. Volunteers have been reverse engineering the GPU, but they still don't know whether their assumptions are all correct. Also, is the Linux support actually official? Considering the above, I think not. I can't vote with my wallet for a company that has no clear map for the future, for my particular usecases. Yes, iDevices are another problem. And yes, paying for the software when you use only the hardware is a problem too. Too many problems with this company. I honestly can't understand why so many other hackers are happy being tethered and parent-controlled by Apple.
      - cassianoleal 4y ago
        > I honestly can't understand why so many other hackers are happy being tethered and parent-controlled by Apple. Obviously it varies from person to person. Some just don't care about this at all and/or don't consider it an issue. Some are just really used to it, or invested in the platforms, and don't want to waste time moving. Some will just find much worse experiences for their taste anywhere else. There are likely other personas in this story, these are just off the top of my head.
        shanebellone 4y ago
        I haven't used Apple in 5-8 years. I prefer to build my desktops and don't use my phone much, so Android is sufficient. Frankly, I do not understand the disdain for Apple. They built their stack. That should be admired. Also, it's one ecosystem in the market. Don't like it? Buy something else.
        EricE 4y ago
  - 2OEH8eoCRo0 4y ago
    I agree, that's why I don't buy them. All of my computers are 9+ years old and run fully up to date Linux or Windows.
    - frankfrankfrank 4y ago
      I’m not sure what would make you think that Windows is even in the slightest better. In fact it is proven that not only is Microsoft deeply in bed with the whole US Government, but the amount of vulnerabilities and flaws and outright back doors that have been publicly exposed in Windows is wildly larger. I don’t even understand this immense focus on criticizing Apple, as valid as it is, when people use Android and Windows and Google services that are all shown as clear hangar door sized vulnerabilities. It really kind of boggles my mind. Apple is constantly being out under pressure by the government and is constantly pushing increasing security and privacy features, as imperfect as they may be, but that is in comparison to Windows and Android, folks.
      - 2OEH8eoCRo0 4y ago
        I use Linux but have a barebones Windows 10 install for one stupid stressful game that doesn't work on Linux due to anticheat. I audibly groan when rebooting to Windows to play. With that said I can still use Windows without a Microsoft account.
        daf203723087 4y ago
        > With that said I can still use Windows without a Microsoft account. Only because you are a power-user and know the magic trick to perform when installing Windows to avoid signing in with a Microsoft account.
        CharlesW 4y ago
        > With that said I can still use Windows without a Microsoft account. It sounds like you may not realize that you have never needed an Apple account (i.e. an Apple ID, which might call an "iCloud account") to use macOS. No magic tricks are required, although some Apple services will naturally not be avaiable.
  - themitigating 4y ago
    I don't think more government regulation for such a specific reason is a good idea. Just don't buy their products.
    - alwayslikethis 4y ago
      At some point this "voting with your wallet" argument gets ridiculous. How realistic is going through life without one of these slaveware devices? (defining slaveware as hardware or software that treats you as a slave to the corporation that made it) Most people are coerced to using it, not even knowing the difference, forcing you to use the slaveware as well.
    - oneplane 4y ago
      Do you really think the general consumer knows about any technical details of the products they buy, and if they did, they would care enough to chose the less-comfortable option for no perceived gain? This almost never works, and I think you know that.
      - themitigating 4y ago
        Do you really think the general consumer knows any medical details of the vaccines they buy? Should we regulate misinformation?
        LarryMullins 4y ago
        We regulate vaccines, don't we? If you're so opposed to government regulation, vaccines are a very strange example to bring up.
  - dotancohen 4y ago
    > There should be a law against that sort of thing, for hardware that you fully paid for. Why? That sounds like exactly the type of issue that the market will fix, by buying from a different vendor.
    - oneplane 4y ago
      It seems the market isn't what you tink it is. At the same time, people also don't understand that the issue isn't what they think it is. There is a vocal minority on most of these things: - Powerusers and "learnt just enough to be dangerous" users complain about products not being targeted towards their wishes - Privacy alarmists don't like what they can't control - Commercial interests don't like having to pay for things, but do like getting paid for their own things Technically all correct, but in practise this is nearly all in the same bucket as fastfood, sugar, air pollution etc. It's something that affects everyone, but it's much easier to deny it, ignore it, and just go with the nice, easy, comfortable, and profitable paths.
      - dotancohen 4y ago
        > It seems the market isn't what you tink it is. Then what is it? I think that the market is an opportunity for companies to compete on features, price, service, and quality. Is that incorrect? If Apple is not competing on features, then shouldn't the market provide an alternative company that does? Specifically, Apple requires a network connection to its servers to used basic functionality yet consumers do not like this. Other companies provide devices that do not require a network connection to its servers to used basic functionality, though possibly at a higher price (doubtful) or lower quality, or worse service. But the opportunity does exist. I'm happy to hear where either my understanding is wrong, or where the market is failing.
        oneplane 4y ago
        Just look around you, do you see any critical mass on both the vendor or consumer side that does something the way you describe it? Every time someone comes up with some confident theory on markets or how things should be, or how bad the things are as they currently are, they forget that the reality is 'the market' (whatever their definition happens to be at that time) did not, in fact, change due to either supply or demand. So when you were to say "the market demands offline devices, and the big companies are failing because they don't deliver that", you're either talking about a theoretical market, or about a different market, but not about the mass consumer electronics market. Because the big companies aren't failing, and regardless of the demand, no significant portion seems to be supplied.
  - Someone 4y ago
    > There should be a law against that sort of thing, for hardware that you fully paid for. So, if Apple were to say you didn’t fully pay for the hardware, it would be OK?
  - EricE 4y ago
    You can. It's just if you do disconnect from Apple entirely, then certain features like Visual Lookups break - unsurprisingly. Not sure why there is this persistent myth that you can only use Apple tech if "connected" to Apple.
- marcosdumay 4y ago
  > It would be colossally stupid for them to betray user trust in that way Yes. Unless, of course somebody is pointing a gun to their heads and forcing them, like the US government was already caught doing to other companies.
  - slenk 4y ago
    Interesting. Do you have any more info I could read regarding that.
    - martin_a 4y ago
      Ever heard about the CLOUD Act? Or the PATRIOT Act?
  - NineStarPoint 4y ago
    I can think of lots of examples where the US gov secretly forced companies to hand over data they were already collecting, but not really any situations where the gov secretly forced companies to start collecting data they weren’t already. Are there examples of the second?
    - colanderman 4y ago
      Does this count? https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- 1vuio0pswjnm7 4y ago
  "For the record I don't believe Apple is collecting that info - having said that I think the biggest issue with Apple is that it is not possible to fully audit and determine what they collect and what they don't." This begs the question why is it not possible. I monitor the traffic on the computers I own which means I have sometimes to decrypt traffic from applications and then re-encryot before sending from the loopback to the local network I own and then over the wire onto "the internet". I like to know what data applications are sending or trying to send. I like to have control over it. That's not unreasonable in the slightest. Yet, in the "tech" company model of computer network use, the computer owner is discouraged, e.g., scary browser warnings, SSL errors, connection failures, etc., from placing any trust in themselves. Instead it advocates, if not effectvely mandates, placing trust (and fees, i.e., for "domain names") in some other entity, e.g., Apple, other "Certificate Authorities", etc. The mere act of questioning this model is often attacked by "tech" workers commenting online. Watch it happen in the replies. Under this model, it is as if the the computer and local network owner does not also own the traffic. Who owns the computer. Who owns the local network. Who own the data. Who should be allowed to view it and control it. If anything, one would think the computer and network owner should be allowed to prevent any third party, including Apple, if they so choose, from initiating remote connections and sending data from the computer owner's computer. Even after purchase Apple believes it is entitled to collect data from someone else's computer, over someone else's network. And it also believes no computer purchaser ever has an interest in seeing what data is being collected, by monitoring the traffic, let alone an interest in preventing these connections. There is no option provided to globally disable all phoning home to Apple, to indicate "No, thank you." It was not always like this, folks. I owned older Apple computers that never made such assumptions. The computer belonged to the purchaser. Generally, firewalls were not used to block software pre-installed on the computer by Apple. The so-called "tech industry" has moved the needle and tried to normalise what is IMHO an entirely different scenario.
  - oneplane 4y ago
    > I like to know what data applications are sending or trying to send Good luck with that. Unless you are running a Commodore 64 it is unlikely that a single person can understand, inspect and make decisions on modern operating systems or even individual applications. There was a small window in which you had the option to use your computer as a 'digital typewriter' and 'sometimes send a fax', but expected and supplied functionality this day and age relies on many small components being heavily interconnected, much in the same way that social circles are interconnected, social networks (the digital variant) are based on critical mass (not technical prowess, legal status or privacy) and the amount of people that have narrow/well-defined use cases for their computers are at an all-time low making them less and less significant to cater to. If you had a Apple computer with 10.3 or newer, this was the norm. If you had macOS 9 with iTools, it was the norm as well (for a bit until it got dropped in favour of MobileMe). The old times weren't better, just different (and much less feature-rich). Great for a few power users, bad for everyone else.
cookie_monsta 4y ago
So, Betteridge's Law? https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headlines https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headline...
- b3morales 4y ago
  Sort of, but this article seems to be specifically a response to a recent blog post that said that the answer was "Yes": https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...
  - IndySun 4y ago
    Thank you. I much prefer Sneaks stance on Apple than eclectic light's. Both post enough useful public information to remind people that Apple are not as different to other giants in underhand software tech shenanigans. Eclectic often make us aware of Apple updating software without permission, which is bad enough, and commonly known on this forum. But Sneak will present reasons why Apple users should not become complacent, and for that I am grateful.
    - acdha 4y ago
      The problem is that Sneak tends towards conspiratorial thinking so you need to read posts through the lens of separating what’s factually established from what hypothetically could be done in the future.
      - IndySun 4y ago
        I do, as everyone should, filter. I find his writing straightforward, moreso than the twisted language of an average Apple 'event'. Conspiratorial may sound sensational to some, but saying one thing and doing another is apt and proportional for walled garden tech. It's a wide net cast. That's all.
        acdha 4y ago
runjake 4y ago
Caveat: "Images viewed in apps supporting VLU have neural hashes computed, and those are uploaded to Apple’s servers to perform look up and return its results to the user, as previously detailed[1]." (but not for CASM reasons) 1. https://eclecticlight.co/2022/03/25/how-visual-look-up-works-in-detail-2-object-recognition-and-live-text/ https://eclecticlight.co/2022/03/25/how-visual-look-up-works...
- btown 4y ago
  A bit hard to believe that VLU's NeuralHashes aren't also passed through CSAM detection, when NeuralHashes were first announced to the world in the context of CSAM detection: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... That said, to reiterate the OP, there's no evidence that VLU executes when using Finder or QuickLook alone.
  - mftb 4y ago
    Are you sure? Because in a prior article on the same source your parent linked it would appear that it is being used with QuickLook[0]. "While VLU is taking place, the image being looked up is opened in the floating window of a QuickLook preview." [0]https://eclecticlight.co/2022/03/23/how-visual-look-up-works-in-detail-1-paintings-on-intel-and-m1-macs/ https://eclecticlight.co/2022/03/23/how-visual-look-up-works...
    - btown 4y ago
      Hmm, there is some ambiguity in the author's writing style. I interpreted what you quoted above as "if you are in Safari.app or Preview.app and activate VLU explicitly, it displays the image in a QuickLook window." The author does say in https://eclecticlight.co/2023/01/18/is-apple-checking-images-we-view-in-the-finder/ https://eclecticlight.co/2023/01/18/is-apple-checking-images... that: > Although the original description given was ‘Finder browsing’, for some that might include the display of images as QuickLook Previews, by selecting the image and pressing the Spacebar... [The process triggered from this] is consistent with the briefer task used in Live Text, and quite different from VLU. There is thus no evidence of the generation of neural hashes or any search query by PegasusKit typical of the later stages of VLU... > Local images that are viewed in QuickLook Preview undergo normal analysis for Live Text, and text recognition where possible, but that doesn’t generate identifiers that could be uploaded to Apple’s servers.
cycomanic 4y ago
I don't know how someone can make such a detailed analysis and apparently not understand the limitations of the same analysis. How can such a broad statement be posted otherwise? There could be all sorts of explanations why a connection might not have shown up in their analysis, rate limiting, batch upload, regional settings. It would have been much better to say: "in my tests I could observe any evidence..." or something similar.
poszlem 4y ago
The phrase 'there is no evidence' can be interpreted in two ways, one being that it is highly likely but unproven, and the other being that it has been disproven and should not be believed. I'm afraid we are still in the first version territory given what we know about big tech and Apple's recent behaviour.

ok123456 4y ago

It's wild that you need a firewall just to stop OS features from phoning home every file you preview on your computer.

gjsman-1000 4y ago
Or just turn off "Siri Suggestions" in System Settings as stated in the article.
- c22 4y ago
  I'd probably stick with the firewall just to be safe, thorough, and future-proofed...
  - gjsman-1000 4y ago
    Well... macOS is hardly the worst IoT offender. Roku is unbelievable. ;) Many good reasons to set up a Pi-Hole...
  - Xylakant 4y ago
    You’d need a network level firewall for that - the OS can circumvent any firewall you run on your computer. That would imply that you’re unprotected once you leave your home network. The firewall would also need to inspect all network traffic, including TLS secured connections.
    - deleted 4y ago
      [deleted]
  - VWWHFSfQ 4y ago
    Apple allows itself to bypass the OS firewall so you will need something at the network level.
    - sundvor 4y ago
      .. on every single network you connect your computer to. Maybe there is such a thing as a portable battery powered wireless travel router with proper firewall rules, that can also do VPN etc. Must admit that's something I never looked into.

ramesh31 4y ago

This ignores the possibility that the scan results could be collected and uploaded at a later time, possibly obfuscated within the payload of some other benign process. I fully accept that the sum of engineering and thought by Apple is much smarter than either myself or the average security researcher, and in an adversarial situation such as this, it's far from an impossible scenario. Ultimately, with a closed source OS, we will never really know more than what Apple wants us to know.

djur 4y ago
> scan results could be collected and uploaded at a later time The images could also be analyzed and uploaded by software installed remotely on your computer overnight. If you actually consider yourself to be in an "adversarial" relationship with Apple you should not use their products -- they have uncountable opportunities to attack you.
- deleted 4y ago
  [deleted]
duxup 4y ago
Isn’t that “possible” for any computer or device connected to the internet? I feel like “possible” is doing a lot of work here that applies everywhere.

hbarka 4y ago

I recognize the author’s use of Scapple for the flowchart diagram. One of my favorite visual mapping apps appropriated from the writing, not techie, community.

gernb 4y ago
I read that as some creative way to use Scrapple for diagrams and went to check out what it was. Imagine my disappointment that it was just some poorly named software and not actually diagrams made from scrapple https://en.m.wikipedia.org/wiki/Scrapple https://en.m.wikipedia.org/wiki/Scrapple
- hbarka 4y ago
  Yup, it’s Scapple unlike Scrapple. A strange word without history. Let me add a plug for them (Literature and Latte): https://www.literatureandlatte.com/scapple/overview https://www.literatureandlatte.com/scapple/overview They also have another amazing app called Scrivener, made for writers and novelists, but can hold its own against other note-taking apps.

jsz0 4y ago

Probably untrue but the general trend of Apple throwing in the towel on privacy has made me start seriously thinking about the logistics of moving away from macOS in the near future. I know it's going to be super unpleasant because I've been a 20+ year macOS snob and it's an integral part of how I get any work done. Making a reluctant change is so difficult. I almost hope Apple makes some terribly egregious changes to macOS that will make it easier for me to cut it loose and move on.

deleted 4y ago
[deleted]
indymike 4y ago
I've unplugged as much as I can from both Windows and MacOS. I still have to carry a Mac because of Xcode (and mobile development), Affinity (for design) and from time to time, MS Office (usually to deal with some ancient VBA code). The daily driver is just an LG Gram with Kubuntu, and here's the difference: Command line: Linux wins by a mile. GNU gettext has better tab completion (i.e. it will complete parameters and paths). If you work with Linux servers, it's nice to have the same directory structure... and while brew is nothing short of amazing, package management on Linux (deb, rpm, pacman, etc...) is still the best. Design: A lot of tools have moved to the cloud (i.e. Figma and Canva are getting better) but pro grade design software like Affinity Designer (or Adobe stuff) is still the best, especially if print shops are involved. If Serif ports Affinity to Linux, I will buy it for every machine at my company just to say thanks. Video: Davinci and OSB run extremely well on Linux so life is good :-) Development: Honestly everything is better on Linux... but no Xcode, which is required to distribute to the App Store. Xcode is a nice IDE, but most of the work I do is in JetBrains IDE (GoLand, PyCharm, WebStorm... and occasionally C Lion). On the hardware front, Apple still makes great hardware, but some of the PC manufacturers are making great machines, too (LG, Lenovo, Dell). I'm particularly happy with LG's Gram 17" which has a giant screen and is an ounce or so heavier than a 13" MacBook Air. The M1 and M2 are fast, but a modern i7 or better is plenty fast and you can get one with 32GB for cheap.
tomxor 4y ago
Baby steps... maybe start with dual booting, or a VM, over time you get more and more comfortable as you find the bits you need on Linux or whatever. You will probably never find a replacement for everything, but eventually you get to a threshold where the "Apple Hates Me" vibes > "Not quite everything I want", then you have somewhere to go when you flip the table... You will probably still hate it initially, but the nice thing is that you can work on it, making it into what you want, and unlike with Apple or MS you can make progress... it will stay how you put it, because the authors of the software are not working against you. i.e it gets more comfortable over time, and less of a battle over time. Admittedly how easy this is, is highly subjective, e.g if you are a media person then it's going to be painful whatever platform you head to (although I hear audio and video editing alternatives are getting better).

deleted 4y ago

[deleted]

zwilliamson 4y ago

Does anyone have a list of Apple urls that we can block via something like pi hole? On a side note, I'm actively evaluating options to replace my aging MacBook. Anyone have a System76 laptop?

oneplane 4y ago
Apple does: https://support.apple.com/en-gb/HT210060 https://support.apple.com/en-gb/HT210060 But as others have written: this won't result in what you think it results in.
int_19h 4y ago
If you're looking for a Linux laptop specifically, take a look at StarLabs. https://us.starlabs.systems/ https://us.starlabs.systems/
- dustyharddrive 4y ago
  How’s the build quality?
  - int_19h 4y ago
    I have StarLite and I like it. One of the reasons why I got it was because System76 stuff seemed to have more complaints on average, although it's hard to say to what extent this is the consequence of them being the more well-known brand. Star Labs also has considerable lead time for new orders - assume a few months.

gockflaps 4y ago

It's refreshing to see someone actually take the time to do some proper analysis on this, rather than simply assuming that Apple are up to no good and getting angry about it based on nothing. Nice work by the author, and a well-explained writeup.

etchalon 4y ago

A great rebuttal and investigation into a topic that was raised by a shallow alarmist last week.

titzer 4y ago

It's beginning to look like it wasn't a great move to become so dependent on so much closed source software. "It's open source" they cry. Yeah, system level stuff, just with some closed-source barnacles attached that do god knows what, stealthily, unaccountably, and yet brazen to a terrifying degree. "Trust us". Hmmm.

squarefoot 4y ago

Broadly speaking, if something is closed source and connected, it phones home. Whether it can collect sensitive private data about the user is just a matter of when. The sooner common users realize that, the safer they can be in the future. Unfortunately, spying on users is a well paid business, therefore even without involving 3 letter government agencies and/or conspiracy theories, we should expect every hardware/software manufacturer to attempt to profit from that, if not because pretty much everyone else in the field is doing the same already.

deleted 4y ago
[deleted]

alin23 4y ago

There's also a follow up to that with more findings here: https://eclecticlight.co/2023/01/20/demonstrating-causal-connections-using-the-log/ https://eclecticlight.co/2023/01/20/demonstrating-causal-con...

simonCGN 4y ago

I suppose you should do it the other way round: there is a rumour, you see if it is true rather than assuming it is true and try to find evidence if it is true.

bboygravity 4y ago
What if there's no way to find out if it's true?
- yreg 4y ago
  Then assume it is true when making security decisions, but don't pretend it is true when talking about it in discussions. (imo.)

cyanydeez 4y ago

If apples not building an AI behind each of their users, sell your stock now.

User23 4y ago

If you upload your data to a server that server’s owners can do whatever they want with it. How do people still not get this?

yreg 4y ago
This article is not about people uploading data to a server intentionally, so I don't see the connection. Who are the people who 'still don't get this'?
josephcsible 4y ago
Distinguish between choosing to upload your data to a server vs. working with data on your local hard drive without air-gapping your computer first.
- User23 4y ago
  What’s there to distinguish? You’re knowingly using a program that openly advertises that it uploads your data.

lamontcg 4y ago

What happens if we just delete mediaanalysisd? I really don't need visual search algorithms using Apple's cloud servers.

CharlesW 4y ago
You can also just turn off Siri Suggestions: https://eclecticlight.co/2022/04/08/how-to-enable-use-and-fix-visual-look-up/ https://eclecticlight.co/2022/04/08/how-to-enable-use-and-fi...

JayGuerette 4y ago

Apple isn't creating neural hashes for CSAM detection, as they'd have to be in possession of source material to create them, so they're getting them from someone else. Since it's indistinguishable in it's hash form, when the supplier becomes interested in looking for something else, nobody will ever know.

yreg 4y ago
>so they're getting them from someone else Is there any evidence they even do neural hash CSAM detection?
echelon 4y ago
Do not let Apple off the hook. This must be removed. This functionality will be used in other global jurisdictions to clamp down on freedom. In a world where we cede more control and increasingly subjugate ourselves, it's only a matter of time before it's used against us too. Say no to monitoring.
- brookst 4y ago
  So the thing the article concludes isn’t being done, must be removed?
  - echelon 4y ago
    Maybe that's the case. We should be vigilant and treat the concern with utmost seriousness. Once upon a time, Apple announced they would do this. We can't ever let them.
  - nostromo 4y ago
    The article concludes that there isn't evidence it's being done -- which is different. Apple should not be trusted without evidence. We should be able to verify what our devices are sending to Apple, Google and others.
- onethought 4y ago
  But they aren’t monitoring. And a hash doesn’t help you monitor unless you’ve got a hash of another image like CSAM. And you can turn this off if you want. Honestly I know everyone thinks that everything is a slippery slope to death camps. But sometimes it’s just a cool helpful feature.

ChrisMarshallNY 4y ago

> Basing claims on the inference that two events might be connected, without understanding the nature of either, is reckless if not malicious. It can easily happen, though. I did it yesterday, with a bank, concerning a credit card number that had been purloined. It was unwise, and reckless, and I ended up owning it, and apologizing (plus, I learned about a trigger that I need to watch out for). That said, just because something "easily happens," does not make it OK. We can "easily" get homicidally angry, and it would be A Bad Thing, if we acted on our impulses. A mark of my personal maturity, is grounding these impulses, before they make it to the outside. When I fail (like yesterday), I get embarrassed.

deleted 4y ago

[deleted]

nbzso 4y ago

After CSAM case I lost trust on any big corporation, the trend for digital control and spying is publicly announced by governments. The global planners in Davos are saying it clearly. So, when the option to run Little Snitch is removed from the macOS, this platform will die for me. I had a hard gripe with Apple since 2015, sadly the UX design team needed to work with Sketch. After CSAM, all developers in the office use Manjaro. We use macs only for the design related workflows. Nowadays, we are lucky that Figma is working in the browser and the switch for the designers will be less hard. On a smartphone front, I reduced my usage to banking apps and phone calls. If I have to take a photo, I use a camera, RX100 or Leica with real lens.

kalleboo 4y ago
> Nowadays, we are lucky that Figma is working in the browser and the switch for the designers will be less hard How is storing all your files in the cloud a solution to worries about local image scanning?
- nbzso 4y ago
  1. Work related files. 2. Collaboration process. 3. There is no alternative for Figma at the moment. 4. Penpot.app is something to look for. They are open source and have an option to run the software on your own cloud/server. But they are not the industry standard, and the tool is without the extensive plugin community of Figma.

spritefs 4y ago

I see a lot of people talking about firewalling in this thread... Apple owns the whole IP range 17.X.X.X, so you can just put the below line in /etc/pf.conf to block all talk with those IPs block drop from any to 17.0.0.0/8 Also for an additional layer of protection, you can add these domains to the hosts file: https://gitlab.com/intr0/AppleBlock/-/blob/master/AppleBlock.txt https://gitlab.com/intr0/AppleBlock/-/blob/master/AppleBlock... Also I see a lot of people trying to defend apple in this thread. Imo life is too short to defend a corporation this large (unless you have a financial incentive to maintain trust in it, obviously)