4 ms·

My point is that she is appropriately characterizing what she's being asked to do. > Real harm is happening ... and these proposals would be very unlikely to

My point is that she is appropriately characterizing what she's being asked to do. > Real harm is happening ... and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children. > boogeymen You said it, I didn't. > Technical people are supposed to find optimal technical solutions, not pretend to be technocrats or underdogs fighting against governments who are all unjust and out there to get us. Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter.

_8j50 3y ago
> and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children I would want to hear your explanation for that but more importantly, you should convince lawmakers about this instead of claiming the tech is impossible. > You said it, I didn't. Yes I did, hope you got my point then. > Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter. I fully support tech people opoposing this law, so long as they don't claim apps can't scan messages before transmission which is obviously a lie. Of course the apps security is reduced and they can have opinions by how much, but so long as the security property and risks are communicated to policy makers and users honestly I have no problem with it. What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. But if you read my comment, apple and google should do this, not Signal, but then again them or telcos pushing code that modifies appls like Signal would be much more insecure than Signal itself doing it nice and neat.
- Hizonner 3y ago
  > I would want to hear your explanation for that but more importantly, The people who want it need to prove that it will help. I had started in to list paragraphs and paragraphs of failure modes, unintended consequences, and directly bad effects, but then I realized that that implicitly accepted an inappropriate burden of proof. I am tired of hearing "Something must be done. This is something. Therefore this must be done". Tell me, in detail, how any of these proposals will help. Include all of the steps from the initial scanning through the final removal of harm. Do not stop at "Authority(TM) will know about X, so they can fix it". Tell me how they will fix it, and how they will do that without doing harm. Not how they theoretically could. How they actually will. And make it plausible. After you've given me that, I'll be happy to rip it to shreds for you. Otherwise, if you can't figure out for yourself how it's harmful to give platforms massive incentives to shut down anybody who raises costs by triggering too many false positives, how it's equally harmful to give them massive incentives to broaden their definition of what's a "true" positive, how it's harmful to have thousands of random people viewing false "hits", how it's damaging to enable Authority(TM) to come down on kids for communicating among themselves, how it's dangerous to create a massive database of blackmail material on potentially vulnerable people, how it's trivial to repurpose a spying infrastructure for different targets, or how it's useless to give more reports to law enforcement that's overwhelmed with the reports it already has, then you'll have to content yourself with reading the vast volume of stuff other people have written up about the OSB and all the related proposals. > you should convince lawmakers about this Many of us have been trying. The OSB has not in fact passed yet. The EU and US proposals still less. > instead of claiming the tech is impossible. Nobody, not me, not Meredith Whittaker, not anybody, has claimed that client side scanning is impossible, or that you can't turn around and encrypt a copy of a message after you've spied on it. That is a straw man. It is entirely your fantasy. What they've said is that it's stupid and contrary to the whole point of having the encryption in the first place. It leaks information that's supposed to be private, including false positives, and paints a target on the most sensitive stuff. It creates infrastructure for abuse. Those are the "security properties" being "communicated". And that is 100 percent true. When she says "back doors", she's talking about system back doors, not necessarily protocol back doors. Although the protocol would have to have some way to report the data. Anybody with a remotely clear-headed view of the situation understands that sending off plaintext copies of the stuff you then turn around and encrypt is in tension with the purpose of doing the encryption. They also understand that once you have either the scanning or the reporting system in place, there's nothing that controls how it can be used. And they understand that the proponents of this stuff have no detailed story at all about how the leaked plaintext is supposed to be secured after the leaking is done... especially if it's actually going to be used for the stated purposes. That is a VAST technical and organizational problem that's constantly handwaved. > What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. That's another fantasy of yours. She's been very clear that if the UK does this, Signal will exit the UK market. However, that's her and her corporation. It's not binding on the rest of us. The fact is that "lawmakers" do not have infinite legitimate power. It is sometimes right and maybe even morally required to directly break the law. Personally, I'm looking forward to the widespread use of P2P tools that will make Signal look like an open book... whether they're legal or not. At this point, laws even in the "free world" are descending into insanity.

_8j50 3y ago

> and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children I would want to hear your explanation for that but more importantly, you should convince lawmakers about this instead of claiming the tech is impossible. > You said it, I didn't. Yes I did, hope you got my point then. > Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter. I fully support tech people opoposing this law, so long as they don't claim apps can't scan messages before transmission which is obviously a lie. Of course the apps security is reduced and they can have opinions by how much, but so long as the security property and risks are communicated to policy makers and users honestly I have no problem with it. What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. But if you read my comment, apple and google should do this, not Signal, but then again them or telcos pushing code that modifies appls like Signal would be much more insecure than Signal itself doing it nice and neat.

Hizonner 3y ago
> I would want to hear your explanation for that but more importantly, The people who want it need to prove that it will help. I had started in to list paragraphs and paragraphs of failure modes, unintended consequences, and directly bad effects, but then I realized that that implicitly accepted an inappropriate burden of proof. I am tired of hearing "Something must be done. This is something. Therefore this must be done". Tell me, in detail, how any of these proposals will help. Include all of the steps from the initial scanning through the final removal of harm. Do not stop at "Authority(TM) will know about X, so they can fix it". Tell me how they will fix it, and how they will do that without doing harm. Not how they theoretically could. How they actually will. And make it plausible. After you've given me that, I'll be happy to rip it to shreds for you. Otherwise, if you can't figure out for yourself how it's harmful to give platforms massive incentives to shut down anybody who raises costs by triggering too many false positives, how it's equally harmful to give them massive incentives to broaden their definition of what's a "true" positive, how it's harmful to have thousands of random people viewing false "hits", how it's damaging to enable Authority(TM) to come down on kids for communicating among themselves, how it's dangerous to create a massive database of blackmail material on potentially vulnerable people, how it's trivial to repurpose a spying infrastructure for different targets, or how it's useless to give more reports to law enforcement that's overwhelmed with the reports it already has, then you'll have to content yourself with reading the vast volume of stuff other people have written up about the OSB and all the related proposals. > you should convince lawmakers about this Many of us have been trying. The OSB has not in fact passed yet. The EU and US proposals still less. > instead of claiming the tech is impossible. Nobody, not me, not Meredith Whittaker, not anybody, has claimed that client side scanning is impossible, or that you can't turn around and encrypt a copy of a message after you've spied on it. That is a straw man. It is entirely your fantasy. What they've said is that it's stupid and contrary to the whole point of having the encryption in the first place. It leaks information that's supposed to be private, including false positives, and paints a target on the most sensitive stuff. It creates infrastructure for abuse. Those are the "security properties" being "communicated". And that is 100 percent true. When she says "back doors", she's talking about system back doors, not necessarily protocol back doors. Although the protocol would have to have some way to report the data. Anybody with a remotely clear-headed view of the situation understands that sending off plaintext copies of the stuff you then turn around and encrypt is in tension with the purpose of doing the encryption. They also understand that once you have either the scanning or the reporting system in place, there's nothing that controls how it can be used. And they understand that the proponents of this stuff have no detailed story at all about how the leaked plaintext is supposed to be secured after the leaking is done... especially if it's actually going to be used for the stated purposes. That is a VAST technical and organizational problem that's constantly handwaved. > What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. That's another fantasy of yours. She's been very clear that if the UK does this, Signal will exit the UK market. However, that's her and her corporation. It's not binding on the rest of us. The fact is that "lawmakers" do not have infinite legitimate power. It is sometimes right and maybe even morally required to directly break the law. Personally, I'm looking forward to the widespread use of P2P tools that will make Signal look like an open book... whether they're legal or not. At this point, laws even in the "free world" are descending into insanity.