4 ms·

Apple was concerned about governments using the excuse of CSAM to pass laws which would force Apple to weaken encryption across the board. Whether this was the

Apple was concerned about governments using the excuse of CSAM to pass laws which would force Apple to weaken encryption across the board. Whether this was the right response to such concern is something I’m not unsympathetic towards. Certainly I think it’s reasonable to say that Apple was trying to thread a needle in a way which was never going to please everyone, even if it somehow turns out to have been the least-worst outcome.

guiambros 3y ago
Yes, but to OP's point: this was patently obvious from the onset. Even here the comments at the time [1] pointed to all sorts of potential misuse, political or religious prosecution, dystopian cases of false positives, and that this would leave the door open to future government escalation beyond CSAM. How could they not see that they would have a giant backlash on their hands? Did they overestimate their ability to get away with the "it's for our children" excuse this badly?" [1] https://news.ycombinator.com/item?id=28068741 https://news.ycombinator.com/item?id=28068741
- simondotau 3y ago
  I think Apple was doing the exact opposite. They wanted to do the __least possible thing__ in order to stave away the far worse outcome of intelligence departments using the "it's for our children" excuse to pressure elected representatives to vote for back doors on consumer encryption. The ridiculous thing is that Apple's proposal was functionally identical to what other platform vendors (e.g. Google, Microsoft) were already doing. In all cases — including Apple's proposed system — only photos uploaded to cloud storage would be scanned to see if it matched CSAM already known to the government. The only difference with Apple's proposal was initial "fuzzy hash" calculation would be performed on-device prior to upload, instead of on-cloud after upload. The reason for doing it differently was because it meant (in theory) satisfying both masters — implementing real end-to-end encryption, while not being seen as a CSAM scanning laggard compared to Google, Microsoft, etc. Other vendors just scan all your shit and nobody cares.
  - fmajid 3y ago
    Signal and Meta (WhatsApp) don’t scan your messages. Apple’s actions have shown they are untrustworthy, and even if they’ve reversed this particular decision, compromising on principle has put authoritarians on notice they are open to compromise in the future, like the UK’s horrific Online Safety Bill.
    - simondotau 3y ago
      Pointing out a few app vendors simply isn't impressive. Of course some app vendors can take a stand against mid-tier governments. It's great marketing for them, and the corporate risk isn't so high. It's the platform vendors which have much at stake. And of the three big platform vendors, two of them already scan private photos for CSAM right now — Google and Microsoft. Yet nobody is outraged because nobody actually cares. There's no logical consistency. Google and Microsoft can implement scanning and there's no outrage. Apple went to great lengths to tell everyone exactly what they were proposing to do before they did it, and all the online people are outraged and calling Apple untrustworthy. Sure, whatever.
      - fmajid 3y ago
        Neither Google nor Microsoft operate a secure messaging platform that matters (email, yes, but email security is a lost cause), unlike WhatsApp (and Facebook Messenger), iMessage, Telegram or Signal. I'm not giving Google & Microsoft a pass, they're just irrelevant for the discussion at hand.
        FabHK 3y ago
        The CSAM scanning Apple abandoned, ie the topic at hand, was for the cloud, like the one operated by Google or Microsoft. You switched the topic to secure messaging platforms, which are irrelevant for the discussion at hand.
        simondotau 3y ago
        Why are Google and Microsoft irrelevant to this discussion? Please, be specific.
- heavyset_go 3y ago
  > How could they not see that they would have a giant backlash on their hands? Did they overestimate their ability to get away with the "it's for our children" excuse this badly?" I imagine it wasn't an environment where one could argue those concerns on fair grounds without it being seen as enabling CSAM and shot down. I also imagine it's enticing to call their competitors' products "pedo-phones".
- FabHK 3y ago
  So how come there is no public backlash against Microsoft and Google who scan your cloud pictures in the cloud, enabling political and religious persecution, dystopian cases of false positives, and future government escalation?

guiambros 3y ago

Yes, but to OP's point: this was patently obvious from the onset. Even here the comments at the time [1] pointed to all sorts of potential misuse, political or religious prosecution, dystopian cases of false positives, and that this would leave the door open to future government escalation beyond CSAM. How could they not see that they would have a giant backlash on their hands? Did they overestimate their ability to get away with the "it's for our children" excuse this badly?" [1] https://news.ycombinator.com/item?id=28068741 https://news.ycombinator.com/item?id=28068741

simondotau 3y ago
I think Apple was doing the exact opposite. They wanted to do the __least possible thing__ in order to stave away the far worse outcome of intelligence departments using the "it's for our children" excuse to pressure elected representatives to vote for back doors on consumer encryption. The ridiculous thing is that Apple's proposal was functionally identical to what other platform vendors (e.g. Google, Microsoft) were already doing. In all cases — including Apple's proposed system — only photos uploaded to cloud storage would be scanned to see if it matched CSAM already known to the government. The only difference with Apple's proposal was initial "fuzzy hash" calculation would be performed on-device prior to upload, instead of on-cloud after upload. The reason for doing it differently was because it meant (in theory) satisfying both masters — implementing real end-to-end encryption, while not being seen as a CSAM scanning laggard compared to Google, Microsoft, etc. Other vendors just scan all your shit and nobody cares.
- fmajid 3y ago
  Signal and Meta (WhatsApp) don’t scan your messages. Apple’s actions have shown they are untrustworthy, and even if they’ve reversed this particular decision, compromising on principle has put authoritarians on notice they are open to compromise in the future, like the UK’s horrific Online Safety Bill.
  - simondotau 3y ago
    Pointing out a few app vendors simply isn't impressive. Of course some app vendors can take a stand against mid-tier governments. It's great marketing for them, and the corporate risk isn't so high. It's the platform vendors which have much at stake. And of the three big platform vendors, two of them already scan private photos for CSAM right now — Google and Microsoft. Yet nobody is outraged because nobody actually cares. There's no logical consistency. Google and Microsoft can implement scanning and there's no outrage. Apple went to great lengths to tell everyone exactly what they were proposing to do before they did it, and all the online people are outraged and calling Apple untrustworthy. Sure, whatever.
    - fmajid 3y ago
      Neither Google nor Microsoft operate a secure messaging platform that matters (email, yes, but email security is a lost cause), unlike WhatsApp (and Facebook Messenger), iMessage, Telegram or Signal. I'm not giving Google & Microsoft a pass, they're just irrelevant for the discussion at hand.
      - FabHK 3y ago
        The CSAM scanning Apple abandoned, ie the topic at hand, was for the cloud, like the one operated by Google or Microsoft. You switched the topic to secure messaging platforms, which are irrelevant for the discussion at hand.
      - simondotau 3y ago
        Why are Google and Microsoft irrelevant to this discussion? Please, be specific.
heavyset_go 3y ago
> How could they not see that they would have a giant backlash on their hands? Did they overestimate their ability to get away with the "it's for our children" excuse this badly?" I imagine it wasn't an environment where one could argue those concerns on fair grounds without it being seen as enabling CSAM and shot down. I also imagine it's enticing to call their competitors' products "pedo-phones".
FabHK 3y ago
So how come there is no public backlash against Microsoft and Google who scan your cloud pictures in the cloud, enabling political and religious persecution, dystopian cases of false positives, and future government escalation?