Hacker News Reader

Comment by YPPH | Hacker News Reader

The clear distinction being that iCloud Mail scanning doesn't happen on device.

For my part, all Apple needs to do is move CSAM scanning to the cloud. No service provider can be expected to keep images of child abuse on their servers. Apple would join myriad cloud service providers in scanning for and reporting such material.

My problem is the use of my own device to run the scan. It's a waste of system resources. Presumably, a trivial software update down the line could expand its ambit to locally stored files. And we have the issue of Apple being compelled to run searches for non-CSAM hashes.

View on HN

My problem is the use of my own device to run the scan. It's a waste of system resources.

I'll restate what I posted on another thread about this [0]. There should be a clear, bright line here.

----

In all these threads everyone is coming close to the crux of the issue, but I want to restate it in clearer terms:

There is a sacrosanct line between "public" and "private," "mine" and "yours." That line cannot be crossed by Western governments without a warrant. Cloud computing has deliberately blurred this line over time. This on-device scanning implementation blows right past that line.

Our tools before the computing revolution, and our devices after, become a part of us. Our proprioception extends to include them as part of "self." A personal device -- a tool that should be wholly owned and wholly dependable, like pen and paper -- that betrays its user, is a self that betrays itself.

[0]: https://news.ycombinator.com/item?id=28162412

You're exactly right.

We have a word for what Apple is installing on your device: spyware. And it's worse than typical spyware in that it's using your device to spy on you and report its findings back to law enforcement.

Framing as “on device scanning” is contrary to facts. It’s the client SDK operating the same algo on an upload event image at the client end of the upload API as it would run at the server end, just not having to decrypt it to do it.

But to your theme — there’s no clear bright line in client SDKs.

Devs do not think of these or handle these as if they belong to the user.

If you study the cesspool of user tracking and other privacy violations on iOS devices, it’s mostly developers using the same client-side SDKs across their apps, and users none the wiser.

Sometimes devs also have no idea. At least, they profess surprise and drop these SDKs when the user behavior harvesting is pointed out to them.

For whatever reason, everyone’s OK with this.

Perhaps the line is too blurred between client and server, thanks to emergence of concepts like node.js (“run same code on client or server”) that make this sound like a feature.

Or maybe it really shouldn’t matter where the code runs provided it respects boundaries, or better, those boundaries of intentionality and access are technically guaranteed inviolate.

This is correct. I have no problems of them scanning my icloud mail or photos. I just don't like the idea of there being a system level scanner for a hash database on my device assuming that I'm guilty until proven innocent. I was going to upgrade my iPhone this fall to latest model, now I'm very hesitant to do so and looking at alternatives.

There is an alternative, more reasonable way to look at the Apple proposal.

The scanning occurs in order to upload files to iCloud photos. Your device is attesting that data you upload to iCloud photos is not pre-established CSAM. If you do not like the privacy implications of having your content inspected locally, on your device, simply choose another cloud photo provider and turn off iCloud photos.

You are told about the system and you are free to turn the service off. That doesn't sound like a massive privacy invasion to me.

This comment should be way up. People afraid of "what else" Apple can start scanning on our devices has always been a reality, way before CSAM. If they ever decided to remove the feature, it's not like it will magically make it impossible for Apple to ever scan our devices again in the future. They can run whatever code they want on their device. We've always put our trust on Apple to not do any shady things on our phone. This new outrage makes no sense at all. As you said, people can turn iCloud Photos off to disable the scan. Therefore people need to STFU.

> We've always put our trust on Apple to not do any shady things on our phone

…and now we have a case in point of them doing shady things on our phones. This breaks the trust.

I don’t see what’s shady about this because it’s so public. They could do everything that’s happening on phone on the iCloud servers without telling you. So at worst it uses extra bandwidth per upload and some processing power and thus battery life from your phone. The minor advantage is you can actually inspect their procedural hashing algorithm, though not how they compare images server side.

Sure, they could do something else in the future but that’s alway the risk with every update.

It's the same point as above. They could do shady things with your data on their server. They could do shady things with the data on your phone. They always /could/, and up till now I trusted them not to.

But now they /have/, that is the change.

Ok they lost your trust and it’s completely your choice to make that decision however you want, but how was this shady?

Creating a novel on-device scanning mechanism and claiming that is somehow more privacy is a lie, and therefore shady.

Using that novel on-device scanning capability to secretly report people to authorities, that's beyond shady.

Claiming that the novel hashing algorithm is verifiable by third parties, but simultaneously suing any third parties that try to analyze the actual code running (without being subject to Apple NDA), is mega shady.

Secretly reporting people to authorities based on unverifiable novel image hashing algorithms and only image "derivatives", whatever that means, that's ultra shady.

Pretending that people are somehow "misunderstanding" if they are alarmed by this unprecedented, unverifiable scanning and secret snitching mechanism being run over their private photos, that's extra ultra mega shady, but typical of Apple.

Look at this shitshow explanation. When have you ever seen Apple being so terrible at explaining a feature? None of this smells right: https://www.youtube.com/watch?v=OQUO1DSwYN0

Ok, so you are largely misunderstanding the details.

> Creating a novel on-device scanning mechanism and claiming that is somehow more privacy is a lie, and therefore shady.

Would you rather Apple actually directly look at your images? If not then it is a privacy improvement. Because they are legally required to search their servers for this stuff when directed to by the FBI.

> Using that novel on-device scanning capability to secretly report people to authorities, that’s beyond shady.

Except they don’t actually do that, phones don’t get the hashes to do any comparisons. Sever side comparisons only flags images which causes Apple employees to look at down samples images. Critically they don’t have the authority or incentives to prosecute you.

> suing any companies that try to analyze the code running, is mega shady.

And not something their actually doing.

> Based on unverifiable

Again false people have been looking at the algorithm used.

>Would you rather Apple actually directly look at your images?

No. Why would that be necessary?

I would expect to be reported if I willingly uploaded images matching exact hashes of CSAM to Apple servers. I don't understand why Apple employees would ever be able to, or need to, view my images, and I would expect Apple if it were really a privacy-focused company to never let that happen.

>Except they don’t actually do that, phones don’t get the hashes to do any comparisons. Sever side comparisons only flags images which causes Apple employees to look at down samples images. Critically they don’t have the authority or incentives to prosecute you.

It's client side, that's why we're having this discussion.

This is all a secret process. As I said, Apple employees look at an unspecified number of "derivatives" of people's images in a secret process, and if they tick a box, the authorities get all your data. There's nothing saying how close a "derivative" needs to be to actual CSAM to trigger this process, just "trust us, because children".

No audits, no due process, no mandatory notifying customers that are affected, no notifying of how many total customers were reported every month, just a secret illegal search and snitching mechanism with some crypto mumbo jumbo and "trust us, because children" sprinkled on top.

>And not something their actually doing.

*they're. Yes they are: https://news.ycombinator.com/item?id=28219278

From a comment: > ... “With their left hand, they make jail-breaking difficult and sue companies like Corellium to prevent them from existing. Now with their right hand, they say, ‘Oh, we built this really complicated system and it turns out that some people don’t trust that Apple has done it honestly—but it’s okay because any security researcher can go ahead and prove it to themselves.’”

>people have been looking at the algorithm used.

Who? How? Are you talking about the ones that are gagged by Apple NDA? Link to papers?

As another commenter posted, no amount of spin will make on-device scanning a good idea.

> It's client side, that's why we're having this discussion.

> This is all a secret process.

Those are in contradiction a client side process is inspectable.

This is disingenuous and you know it.

As you know, there is a server-side element, the crypto mumbo jumbo makes it impossible to audit which images will trigger the automated snitching mechanism from the secret list of hashes. So it is both a secret process and doing scanning client-side.

Also Apple is busily suing companies who dare to make client-side inspection feasible, as I noted.

What people make this aurguement fail to understand is that legally there is a HUGE difference between

"We will not make software that scans files on the device"

and

"We will not allow the software we made to scan for anything other than CSAM"

Under US law it would be very hard to force apple to do the first, but no where near as hard to compel them to change the database they of files they are scanning for...

This is a dubious legal theory. The compelled action the government asked Apple to take in the case of Apple vs. FBI was a very minor technical change.

It's not about the technical complexity of the change. It's about the public blowback from such a change. The U.S. government compelling Apple to install some all-access backdoor would be a big story.

The U.S. government compelling Apple to make some small process change to this new system wouldn't be a big story by comparison.

Example: A year from now the U.S. government tells Apple they are no longer allowed to review the flagged CSAM imagery themselves but must rather report it directly to law enforcement.

A change most people wouldn't think twice about ("why does Apple need to be the ones reviewing this obscene illegal material anyway") yet would introduce a massive vulnerability into the surveillance process.

I don’t see what public blowback has to do with legal arguments, at least without also assuming some kind of legal realism.

I wasn't commenting on the law, rather the claim about the technical complexity of the change.

iCloud Photos is a synchronization service that is integrated very tightly into the core iOS system. Even the basic APIs that allow apps to integrate with the system photo library are "iCloud aware" in the sense that the photo might not be on your device. iCloud Photos makes it possible to page photos on and off your device, which is a critical feature for people who can't afford to pay for the high-end iOS devices with extensive NVRAM storage.

You, as a user, can turn off iCloud Photos. But your device functionality will be limited. And you cannot replace that functionality with any third-party alternative that will have the same feature-set and access to the low-level device features: Apple ensures this through the design of their OS and its extensive security features.

There is a version of "you don't have to use iCloud Photos" in which Apple opens their OS to competing cloud services. But you can't say this is an option while also locking the device down to use one cloud provider.

It is hard to square the idea that Apple’s proposed CSAM detection pipeline is a fundamental affront to privacy, a human right, with the argument that turning off iCloud Photos is a false choice because alternatives don’t or can’t have feature parity. Even more so because every cloud photo service with the scale and quality of iCloud Photos is doing the same (and arguably worse!).

I use Nextcloud and it is a more or less ok user experience; the major inconvenience is that your photo library isn’t available in UIImagePickerControllers. The image preview mechanics you describe can already be simulated with file provider APIs.

Edit. I think my point more simply stated is that if you think turning off iCloud Photos or switching photo sync with another cloud provider “solved” the privacy problem, then you are in the same group of people who are annoyed that they can’t use Spotify with Siri or AirPlay 2. Welcome to the large number of 2nd class citizens on iOS. It’s not great out here, but it certainly doesn’t make the toggle a false choice.

I don’t think you need to square those options. I think that scanning people’s photos is very much an affront to privacy. Apple clearly agrees with me at some level because they are advertising that their system is “opt in”: you only get scanned if you turn on iCloud Photos. But this argument assumes that for most users this is a choice. For many users who have purchased iPhones with lower storage levels this is not really a choice — they have to use iCloud Photos to get the functionality they paid for, else they can’t synchronize photos and have to manually manage and risk deleting photos. They can use third party apps, but only with reduced functionality because Apple has chosen to privilege their own cloud service and lock those functions away from third party developers. To me it seems like Apple’s opt-in consent argument would make sense if and only if they offered users equivalent choices in third party cloud functionality: which they don’t.

The user to whom Apple’s offer is a false choice is one that assumed they would always be able to update to the latest iOS while uploading whatever photos they wanted into iCloud Photo Library without any kind of content scanning. Turning private API into public API is a huge investment, and I’ll be honest: this hypothetical user seems quite far-fetched, and I don’t see how this investment is worthwhile for Apple to make. Especially so because most of the criticism is about a slippery slope where all rules don’t apply: Apple could just as easily scan the photos the 3rd party processes as well. So what incremental privacy do they even gain?

You seem to be conflating a number of very different issues. It would be a lot simpler if you didn’t do that.

There are several separate questions. 1) Should users have the right to opt out of scanning. Apple have answered (1) in the affirmative: yes, they understand that some users want this option and have designed their system with explicit guarantees that users can do this. This is not an accident or a miscalculation on Apple’s part. They clearly understand that forcing this scanning on non-consenting users is unacceptable and their marketing copy makes this clear.

The second question (2) is whether Apple’s compromise to preserve user privacy (allowing users to disable photo sync while providing no third-party alternatives with equivalent feature sets) is acceptable. Apple presumably thinks it is. I think that disabling Apple’s photo sync features will not be acceptable — and indeed will be actively harmful to some users. We can disagree about whether this matters but this is the heart of the disagreement. Having strong opinions doesn’t settle the question, it just demonstrates that the issue is contentious. Settling the issue requires user surveys and an economic analysis at minimum, not opinions on HN.

Then there is a third point (3): does Apple have any obligation to provide opt-out users with alternative services that bring their devices back to the full functionality that they possessed when the devices were purchased. Your view is that “this is not worth it to Apple.” We do not disagree. My claim is that Apple’s view on the issue is not necessarily the final world on the issue. Apple also believes that they should have a monopoly on app distribution and many other aspects that define the iOS experience. These views are disputed and there is no “correct” answer. My claim is that the operation of cloud infrastructure should be a part of this dispute, and Apple’s decision to make their system “opt in” should be viewed as such in light of the fact that Apple controls essential features in such a way that Apple can effectively hobble the device of any user who declines to consent, with no recourse or alternative available to the user.

I think your response to this has to grapple with Apple’s very clear argument on (1). Which means that “Apple can do whatever it wants because they’re powerful” isn’t a sufficient response. And if the rest of your answer revolves around unsupported hypotheses about what Apple users expected, then you should probably come back with some strong evidence like user surveys to support those claims.

I agree with your framing except that in 2 and 3, the matter is already settled. The status quo is Apple gets to build what it wants. It’s on you and others to do an immense amount of work to prove that Apple should be forced into building features you want and not what they deem best. I’m generally happy with what they’ve made, and I think the power to compel them to make changes is more likely to be wielded by dumb and possibly malevolent people than altruistic, privacy-focused computer experts.

I’m not sure why the burden to do user surveys is on me. Presumably the first order user survey is, “Will our customers abandon us?” which Apple must have done and everything past that is on you to conduct to justify your ask of them.

Pretty obviously the only reason to scan on-device is that you intend to expand on-device scanning to all files on the device, regardless of whether they are uploaded or not. ("We don't want child molesters to get away by turning off uploads," said Apple spokesperson.) Literally no reason to develop this otherwise. Scanning cloud images would be 100x easier.

Apple has declared their criteria for evaluating the privacy of their CSAM scanning approach in their USENIX talk, and none of it relies on scanning all files. If you want to accuse them of lying, you will need to bring a lot more evidence since (i) presumably you believe they weren’t lying in the past and (ii) it would be an enormous liability if they were now.

There are many reasonable criteria under which the proposed model is superior for privacy. Perhaps the only reasonable criteria under which it is not is some kind of scope creep in what files are scanned. (Scope creep in what content is scanned for is a risk - an even greater one as there is no transparency over the hash list - of incumbent solutions as well.)

Either that, or Apple really doesn’t want their server to access (ie. decrypt) all photos by default. Maybe they actually weren’t lying when they defended being more private by having all computing happen on-device, and the server not accessing your data.

Now, what seems more likely to you? They suddenly decided to go towards scanning all offline files for no business nor legal benefit, or they tried to respect their own marketing of how their ecosystem should work?

What you said changes nothing about the concerns the parent comment/s raised: which is, having the scanning on the device in any manner what-so-ever. That is the objection.

The fundamental issue is that Apple is crossing an important privacy line: my property (my phone) vs their property (their external servers).

It's identical to saying that because USPS (or any mail carrier) is allowed to scan mail that moves through their system, across their property, they should also be allowed to come into my home and scan mail there. Hey, they promise to only look at mail while inside the home, what's the big deal. It represents the same shift: my home vs their shipping infrastructure.

People would universally go ballistic if USPS/UPS/Fedex declared they were going to begin routinely entering homes to examine mail packages before they were sent out. No matter how you dressed that up (they only do it if you print a shipping label first, indicating preparation to send a package through their system), it wouldn't assuage anyone.

iOS doesn't allow other cloud photo services to upload in the background except via flaky hacks, so the choice for iPhone users is really between iCloud Photos and crippled alternatives.

I use NextCloud which syncs my photos from my iPhone to my in-home server. Then I use borgbackup to encrypt my photos/videos and send them to a cloud provider. All of it is automated and wasn't too much of a hassle to setup.

iCloud does more than just uploading. It enables transparent sync and offloading of photos. This means if your device has limited storage, iCloud Photos can shunt photo data out to the cloud while maintaining a local representation of the photo's existence. These iCloud features are "baked into" the APIs that apps use to integrate with the system photo library, e.g.: https://developer.apple.com/documentation/photokit/phasset#1...

You can come up with third party solutions that accomplish some portion of this use case (photo backup) but you'll never be able to accomplish what Apple does with iCloud Photos unless Apple opens its APIs.

A third party could implement the PHAsset abstraction over their own implementation of a photo library action sheet and the file provider APIs. It wouldn’t get you to feature parity, but the major differences are but minor frictions if your privacy threat model involves nation state adversaries.

It is not possible to write an app on iOS that has permanent, transparent background network and runtime access, and it’s also not clear allowing such apps would be a privacy benefit for users at large. Apple already makes exceptions to this for certain apps (e.g. it seems like my Verizon Wireless app has background runtime). Are you suggesting that Apple should nominate a few photo services receive the same exception?

I’m unclear if you’re saying that one can implement a new access mechanism to Apple’s default photo library (the one managed by the Photos app and that the camera saves to by default) or if you’re suggesting that I need to design my own alternative photo album. If the latter, then “but minor frictions” seems… unreasonable.

Not sure what nation state adversaries have to do with a simple question about photo library access.

If your argument is that Apple should be forced to give everyone access to the proprietary abstractions it builds on its own operating systems, like PHAssets, then we are no longer in the world of privacy and now in the world of “when is it ok to force companies to build features the public [HN posters] wants?” There are many answers to this, but it seems like the current legal regime in most places says: “Very rarely.”

My argument is that nothing stops a photo sync solution from building much of the relevant stack themselves: you can build MGAssets and get apps to adopt your photo library view controller as an action sheet or use File Provider abstractions to build the same in file pickers. 1Password, eg, offers a direct to 1P button as an SDK for 3rd parties to use. Once you separate out what you can’t do easily because it would take a lot of investment to build yourself versus what actual platform features you’d like to force Apple to build, I think your argument that the latter should be done is even less compelling.

The question of whether Apple should open the "proprietary abstractions it builds on its own operating system" is a major one that is now being litigated in multiple courts and regulatory jurisdictions. My argument is simply that sophisticated iCloud integration falls into this category and should probably receive attention from those same courts and regulatory insitutions.

To the extent this is about privacy, the argument is that Apple has created an opinionated regime for scanning user photos using untested technology -- and has (quite correctly, I think) determined that privacy-conscious users should have the right to opt out. The issue here is that Apple's version of "opt out" does not allow users access to the same functionality through third-party cloud providers. Users who opt out for privacy and security reasons will be substantially worse off than users who opt in. This isn't the only reason that regulators should consider revisiting Apple's cloud integration, but it's a new and important one that did not exist before Apple announced this service.

It's a benefit for users at large because they get to use services that provide more benefits (like Google Photos search and automatic video creation), services with more privacy (like self-hosted photo services), or services that are cheaper (like Amazon Photos).

Android has demonstrated that there is no need to whitelist this. This is purely a lock-in play for Apple.

We are using Synology Photos in our family.

On iOS devices, it randomly stops synchronizing, and it is necessary to manually resume sync. Very annonying; most normal (not-enthusiast) users would be bitten, that they assume their photos are synced, when they are not.

Interestingly, Android devices do not have such issue.

This is the tradeoff of the Apple ecosystem. For most users the trade off is a no-brainer because they don't care about the theoretical concerns that, in expectation, do not apply to them. I mean, what is the probability of this technology causing an innocent user harm? 1/1,000,000 ? 1/10,000,000? 1/100,000,000?

According to Apple, 1/1 Trillion chance of a false report per year.

So the chance for a single photo to be incorrectly matched is much higher. But by setting a threshold at ~30 images before triggering a manual review, they get the odds extremely low.

My bet is that error threshold will remain a constant for them. As tech gets better, they will reduce the threshold accordingly to maintain that error rate. In five years, I’m guessing they will only need three images to trigger a review.

My pre-owned Pixel arrives tomorrow and I'm looking forward to playing around with open-source alternatives. I think I'm going to start with this: https://lineage.microg.org/

I’m aiming for a used Pixel 5 and GrapheneOS. GrapheneOS seems to have the most focus on breaking entirely away from Google services.

GrapheneOS has been a dream so far on my used Pixel 4.

Turns out Android can be pleasant when you don't have to deal with oem ui changes and non-optional bloatware.

But you do like the idea of a server-level scanner for a hash database assuming that you're guilty until proven innocent?

Yeah, I don't get the cloud/device distinction people are making. Increasingly they are one and the same (if you know what I mean).

ODINN => On Device, Intrusive, Neural Network.

You cannot photocopy a dollar bill. Kinda makes sense.

https://en.wikipedia.org/wiki/EURion_constellation

Now imagine a "live" neural network running on your phone or camera that prevents you from taking pictures of the Eiffel Tower at night due to "Suspected Copyright Abuse".

https://www.snopes.com/fact-check/photographs-of-eiffel-towe...

Next imagine that a local government issues a digital "All Points Bulletin" which scans all pictures on all phones for a "person of interest in a crime (against the state)", conveniently associated with the emergency alert broadcast network.

First they came: https://en.wikipedia.org/wiki/First_they_came_...

>Yeah, I don't get the cloud/device distinction

Maybe I can make it clearer.

It is like you are asked or demanded to install some antivirus on your computer, but this is not a typical antivirus , it is not scanning to protect you but to find evidence against you and destroy your life.

A list of facts, let me know if you disagree with the reality or my conclussion

Apple could have scanned iCloud already, why did they not do it so far? Either there is a super low number of CP on iCloud which implies this feature is not needed OR Apple was lazy, incompetent or had some other reason and let a lot of bad guys escape . I would conclude from this that Apple , if they really care of children, should freaking start scanning the existing iCloud images now.

From the above I am inclined to believe that this is not an action to protect the children, the reality does not fit, if there is so much CP on iCloud but Apple just woke up then WTF is that all PR about protecting children.

With all the attention it has been getting I think its only a matter of time before CSAM-SWATing starts to happen on those cloud services. The amount of people who know that scanning is happening just dramatically increased in the past month.

And for all we know it may have already happened and someone is currently rotting in jail who shouldn't be there.

Middle aged dude raided by cops who find CSAM on their cloud accounts, claims that his phone got hacked. Lying sack of shit pedo, of course he'd say that, right?

We've had plenty of time for it to have already happened since various services have been scanning for CSAM for some time.

> The amount of people who know that scanning is happening just dramatically increased in the past month.

Nobody does, but that's the current status-quo anyways. Almost every cloud-based service provider will do this anyways, Apple's only change is that they've moved their surveillance from their computers to mine. If I can't know how secure my phone is at all times, then I frankly can't feel comfortable using it.

You might find this helpful in your search -- HN Discussion of open source phones: https://news.ycombinator.com/item?id=28164208

> Presumably, a trivial software update down the line could expand its ambit to locally stored files.

And backing up one level, this is why I’m finally working hard to take control of my devices and data from companies like Apple. This most recent episode shows that “a trivial software update” such as the one in iOS 14.3 can introduce this on-device scanning where non existed before. We knew it was possible of course, but now we have a clear cut example of it. They’ve lost my trust and that’s that.

> [...] They’ve lost my trust [...]

Exactly how I feel. I used to cautiously kinda trust Apple's so-called "commitment" to privacy, but this change just shows us that any such promises are purely theater.

Now that the damage is done, I doubt it can be undone, especially in my case. My opinion on Apple's credibility has crashed through the floor. In my opinion, they're now as untrustworthy as Google or Facebook.

For me it's a step further. I cannot trust any company for more than privacy theater. Apple was simply the last to fall.

I'm starting to look at companies to see if they meet these must-haves:

1. E2E encryption

2. Open source hardware and software

Everything else is "nice to have". The current options out there are missing a lot of "nice to haves", but they will get better. I'll be a vocal customer telling them what I want.

"They’ve lost my trust and that’s that."

Same here. There's a finality to this, closure.

I'm done reading about it, nothing more I need to say about Apple. I just purchased a System76 laptop and am ditching my MBP. I've been a Mac Addict for 20 years and now I've outgrown Apple. Privacy is a human right.

What I'm wondering now is "how do I replace my iPhone, AirPods, and iPad?"

Ask HN: Do you use Purism, PinePhone, or Fairphone? https://news.ycombinator.com/item?id=28216287

Ask HN: Do you use a Linux-first laptop? (System76, Librem, Dell XPS Dev Ed) https://news.ycombinator.com/item?id=28216287

Me too. Not a huge Mac user, but I use my iPad and AirPods a lot.

I haven't tried them, though the Sony ear buds look like a great option to AirPods: https://www.sony.com/lr/electronics/truly-wireless/wf-1000xm...

As far as the tablet goes... I dunno. I haven't tried an android tablet and I'm not too keen on it. Maybe a Surface? The iPad is damn good at what it does...

The biggest convenient of AirPods for me is how damn easy they connect and disconnect. Wonder if there's a way to support that on other devices and platforms. It's a dream.

And yeah, iPad...

Pinephone has options: https://pine64.com/product-category/tablets/

“Trust” is entirely my issue with Apple too. I spent some time - and even wrote a post on my site - trying to clarify my thoughts and the steady erosion of trust seemed to be what I most object to. I too am trying to take control and responsibility for the computers I use now. Proving tricky, but baby steps…

Just read through your blog post, there's plenty of great insights on there and I appreciated someone being so thoughtful and tactful with their response. As a Rust developer, I fully encourage you to push through and learn the language: I've walked a few tenured web devs through the language, and they're always surprised by how strongly typed and simple everything is once you understand the syntax. Truly one of my favorite languages to work with!

As for 'alternatives' like you listed towards the bottom, I fully recommend setting up your own Nextcloud instance. It's a really versatile little thing, capable of hosting your photos/documents/music/whatever from a decent online interface (or WebDav, if you're a nerd.)

Care to share the link to the post on your site?

Not that person but is this it?

https://madebyjamie.design/articles/2021-08-20-advocating-fo...

The point was so they wouldn't need to see the plaintext of the photos on their servers.

Somebody needs to invent a FHE (fully homomorphic encryption) CSAM algorithm, so that Apple could scan encrypted photos for badness on the cloud.

In some ways, I think privacy advocates could be shooting themselves in the foot here. I think that mainstream storage encryption (mainstream as in WhatsApp and Signal, as opposed to encrypting your NAS using linux commands) is very important for privacy, and that deploying it without running into CSAM objections and legislation is a Sisyphean task for for-profit businesses. Messaging seems to be more legally defensible than storage from a business perspective.

If you take as an axiom that mainstream businesses will be forced to protect themselves against contributing to CSAM distribution, then the choice to offer encrypted cloud storage to non-technical end users REQUIRES doing the scan on a trusted computer (Apple has chosen the phone itself).

I think the arguments that this can be abused are very real, but it's worth talking about how to fix that, because I think the alternative might be sacrificing E2EE cloud storage in the mainstream (as has happened with every other mainstream company). Perhaps more thought should be put into making this process auditable by the device owner (or by a trusted 3rd party -- say the EFF).

Or perhaps the scanning could be federated -- say I don't want Apple doing that, but I might trust a privacy oriented non-profit to "certify" to Apple that my personal photo album is CSAM-free. Can that 3rd party scan be blinded, such that I send data that is representative of my images, but I've already anonymized my photos using a transformation?

Could we audit (similar to certificate transparency):

1) What data from the device is being scanned? What data is being uploaded?

2) What "hashes" are being matched against, and how are those changing over time? Can the data lineage of the NCMEC database be audited? Would that pick up malicious hashes injected into the database?

Generally, I think our privacy paradigm needs to be built in such a way that it can actually be deployed in our policy environment. More realpolitik, less ethical grandstanding.

Are photos uploaded to iCloud encrypted client-side?

I suggest the answer is in the negative, given the ability to look at them on the web, and the ability to reset your iCloud password using 2FA.

These suggest Apple has a copy of the decryption keys, which I'm happy for them to use to scan files I have stored on their servers, for CSAM, or, within reason, anything.

> Are photos uploaded to iCloud encrypted client-side?

Well, I can share a link to them and others can see them, including anonymous users. Just leads me to believe that either they aren’t or if they are, they have the key.

This boils down to “I have nothing to hide.” I encourage you to review https://www.schneier.com/essays/archives/2006/05/the_eternal... and consider if you really feel this way.

Not Cool, now we can enforce all kinds of arbitrary censorship on encrypted data. Be careful what you wish for.

Also, the Apple system allows for a way of verifying matches to screen for false positives which the encrypted approach would not.

FHE doesn't let the other party access the results of algorithms run on your data. Other parties can run an algorithm on your encrypted data, but only you can interpret the results.

That's a good point. The device with the key would still have to forward the results.

Alternatively, someone could realize that existing CSAM that's so widespread it's in the database basically equals water under the bridge, whereas creating CSAM that isn't in the DB requires to harm more children.

Poverty and power imbalance is what harms children the most, by far. But we can't tackle that without stepping on the toes of greed, so we do circus instead.

You say water under the bridge, others will say where there's smoke there's fire.

But this isn't smoke, this is a photo of smoke. And as I said, the raging fires all of us can see in plain view go mostly unchecked. Where there is a photo of smoke, there may be fire, but where there is obviously a huge blazing fire, there surely is fire.

You've hit the nail on the head for me. The part that offends me is that the scanning is happening on my device that I paid for, and had no knowledge of the eventual introduction of when I bought the phone.

If they want to scan cloud storage, by all means. But I shouldn't have to have my device bogged down with this extra pointless computation.

The idea that it’s going to slow your device down is an odd one.

Genuine question. I know this is not the situation we find ourselves in but, if your options were on-device scanning for CSAM+encrypted iCloud Photos (that Apple could not decode) OR cloud-based scanning of iCloud Photos which would you pick? Are you still opposed to all on-device scanning?

Edit: Thank you all for your replies. I don't share the exact same concerns as some of you but I appreciate you sharing your thoughts/reasoning. I really did what to know what people thought about this in the context of an E2E iCloud-* and it's been hard to pick that out of all the other discussions.

I'd happily pick cloud based scanning. At least that way I can opt out by not using their cloud. I have serious doubts that choosing not to use iCloud will actually stop Apple from running scanning code on my device. Having a capability pretty much ensures that it will be used, and likely misused.

So long as I'm confident that disabling the iCloud Photos service also disables the scanning, I prefer the local scanning + e2e encryption.

(My take is that if I can't trust Apple when they say this is the case, I also can't trust that they're not already being made to scan all my photos locally, so...)

Apple shoving this false dichotomy at us is the problem. I choose option #3 - Apple (et al) freely scan everything stored in their cloud, while users' devices use encryption that renders most scanning moot.

I'd pick the latter. I doubt iCloud will ever be a zero-knowledge service.

Probably the latter, because frankly E2E encryption means very little to me when one end is the world's most powerful company.

My house shouldn't be full of eyes and ears.

CSAM today, political materials another. This could also be used to identify whistle blowers, reporters' sources, and more.

I'd hate to have gay porn on my iPhone in a Sharia law state.

Or images of tank man in mainland China.

Imagine when the detector extends to not just files. Things typed or said.

This is a steep cliff, and we're drawing closer to the edge.

> Or images of tank man in mainland China.

The Chinese government forcibly installs spyware on people’s phones today. What Apple does or doesn’t do is of no consequence to them.

> The Chinese government forcibly installs spyware on people’s phones today. What Apple does or doesn’t do is of no consequence to them.

And that makes this okay? You're defending this use against us too.

Did someone say it was ok? The point is that it’s silly to say this CSAM mechanism makes a difference in China.

Does the US government have the power to order Apple to scan everyone’s phones for politically undesirable images?

I don’t think so.

Ideally they wouldn’t be able to scan my iCloud photos at all. There’s real value in being able to maintain privacy while also gaining the benefits of live, remote storage and backup.

The generous interpretation is that Apple moved this on-device to preserve user privacy. They just miscalculated the response to an admitted backdoor.

> Presumably, a trivial software update down the line could expand its ambit to locally stored files.

Sure but this is equally true now as it will be after they deploy the CSAM detector.

It’s not a real argument against the detector.

This is exactly what I complained about in past threads and nearly nobody agreed with me there. Seems like the tide has changed!

This is my only complaint. I don't care what you do on your own cloud, don't try and force my device to do the heavy lifting especially when the activity is not in my own interest.

I asked in another thread (and got downvoted), if Apple does it on the user devices to save money. How much would it cost to scan everything on the serverside?

Doing so would sacrifice privacy. I'll take the hit on my battery.

Reply on news.ycombinator.com