Hacker News Reader

Comment by nbzso | Hacker News Reader

Apple lost me as a customer completely with CSAM this year. But I am thankful because I dramatically reduced my smartphone usage to incidental and mandatory use-cases.

For me this is a strictly personal stance.

People will continue to fall into deep surveillance state not just because only “Nothing to hide” false assumptions. Governments love access to citizens data and partnership with corporations is guaranteed.

On a professional level I “trust” only FOSS software with network access, the others will be air-gaped as much as possible.

View on HN

While personally decidedly not a fan of this, Apple's proposed attempt on CASM was quite different from what is generally alleged in that article.

In principle it matched a downloaded set of encrypted hashes of known offending images against any images before they were uploaded to the iCloud and this locally. A recorded offence would result in a local warning, and, if you proceeded, the offending image would have been exposed to further scrutiny and review (by this breaking the end-to-end encryption promise, but you would know and this would have implied your consent). It's not that far from Gatekeeper and other signature matching malware detectors. You may have already problems with the latter, but this is basically where we are.

The other thing they did was use AI image recognition to scan images sent via text. This wasn't a hash match and much more dangerous. I'm not sure why people get fixated on the CASM thing while ignoring this; this seems much worse to me.

The first feature of the three features will use the phone’s on-device machine learning to check the content of children’s messages for photos that look as if they may be sexually explicit. That analysis will be done entirely on the phone, Apple said, and it will not be able to see the those messages.

If a child receives such a message, it will be blurred and the child wil be warned that it could be sensitive and given information about such messages, as well as being given the option to block the contact. If a child decides to view a message, they will be told that their parents will be alerted, and an adult will then be notified.

https://www.independent.co.uk/life-style/gadgets-and-tech/ap...

> The other thing they did was use AI image recognition to scan images sent via text.

I think, this would have used the already built-in Vision framework [1], which runs locally, and only on any attempts of publishing to the iCloud. This is really the conflicting point: while it should be implemented at the publishing end, the concern for end-to-end encryption prevents any such idea, for which has to be migrated to a local service.

Regarding the procedures and treatment of children as receivers of such images, this is an actual (while restricted) leak, but it's a fact that minors are not recognised as independent individuals or as deserving much privacy of their own. It may be deplorable, but that's pretty much established in society and by law. Also, it may be argued that proceeding to view such an image after a warning implies consent.

[1] https://developer.apple.com/documentation/vision

>and only on any attempts of publishing to the iCloud.

The feature I'm referring to happens regardless of publishing to the cloud. It scans text messages real-time and uses AI rather than a hash of known/existing images. The other feature everyone is talking about uses CSAM hashes and scans only when publishing to the cloud, but of course that feature can be easily changed with a bit switch.

Is your objection an objection to parental controls on children's [1] devices in general, or is there something particular about that one?

[1] The description you quoted only applies to children under the age of 13. For children 13+ it still warns them, but if they elect to view anyway their parents are not notified. In the under 13 case if the child elects to view the material they are reminded that their parents will be notified if they do and given another chance to cancel.

It's not the parental control, it's the ability for Apple to spy on them with it. You are assuming their stated intended use 1. Is 100% accurate, 2. Will always be 100% accurate, 3. Won't be used by law enforcement with a warrant.

I more object to how it can be used more so than their stated use. The best way to ensure that I or my kids won't be spied on with AI searching text messages/images is not to have the ability exist. Trusting corporations to do the right thing doesn't go very far.

I'd argue, trusting an OS vendor with built-in services and apps is a much more secure bet than trusting the vendor of any random app. Simply, because they are easily caught (just a single user has to sniff the traffic) and trust is a major requirement for selling an OS. The incentives for compliance are high as are the stakes. Any change of policies would be most likely advertised openly as an improvement, and then it may be the right time to jump off the train.

I'd argue that we are in times when "trust" must be a result of open code access.

If in the past the GNU philosophy sounded somewhat extreme, today is the only real valuable option from a consumer perspective.

This are our intimate lives that we are talking about, that's the whole incentive for corporations to provide "advancements" for free - the personal data, gathered, categorized and automated for billions. "Solutions" sold to the public with marketing strategy "for the common good".

In actuality, we as a collective have fallen into this trap. Driven by consumer lust and "social" success validation, emojis, colors and tech specs. We are sick to the core - watching unboxing and tech fetish videos.

I am guilty in this as others, I have used Apple products for 20 years.

The only justification that I have - I had fallen into this trough my work as a designer. At the time I had no idea about how software works and what is the perspective for the industry in the future.

Since invention of the iPhone things changed dramatically. What are advancements for the end-user really? Better cameras? Or higher and higher prices? My last iPhone is SE with the old form factor - not updated and still working.

With CSAM and "parental AI" scanning proposal, Apple tried to normalize active policing on the device by third party criteria with no option of auditing (because of the sensitive nature of the data). UK government chimed in to approve and require even more access.:)

This operation is a failed text-book psyop. To make you comfortable when I am scanning your data in the name of the children (if you don't approve you may be have something to hide), you will be able to participate in the surveillance spectacle by snooping on your kids. Hm, no. Utterly Disgusting.

How removed from reality one must be to even create this intrusion on privacy is beyond my comprehension.

The good part is that this Apple "mistake" was like jolt of thunder for me and my colleagues. There is no more Apple tech talk in the office, sharing of Apple related news and speculations.

We don't care to support another monopolistic monster in the shareholders approved crusade to rule the world trough health, media and transportation data.

You cannot be a technically educated person continuing forward with closed eyes and singing along the corporate mantras anymore. Yes, the paychecks are good, I have no doubt.

I now understand why FOSS exists, and I am sincerely thankful for all the people involved in the process of creation of the real software advancement for humanity. And if I cannot participate directly, I will find a way to support this process financially.

You are generally right. Mind that this (commercial OSes) is on an entirely different level. However, I'm afraid, if there was a way to effectively commercialize FOSS software, it would have gone the way of e-mail or Usenet.

Regarding iPhone (and smartphones in general), I'm with you. However, I don't think that this ill-fated CSAM filtering attempt was meant to establish intrusion. At least, if I was Apple, I would go a long way to avoid becoming a transparent tool for law enforcement and intelligence. There is no win down that route, only pain, lots of pain. They are doing fine without it, already.

Not knowing about the ability of it to do that is not evidence that the ability doesn't exist. You were already trusting them not to do this before, since they had full access to the texts and images as the developer of the app.

The development of systems that can recognize these kinds of images predates this and you likely have been previously aware of them already existing and the ease of deployment of them.

Trust of Apple is already all that stood between them being abused and them not being abused.

I don't really understand what argument is being made here.

You're depending on Apple not tampering with or receiving a tampered CSAM hash list. The same company that opened Chinese iCloud to the ccp, took down a voting app when asked by Russia and generally blows around like a leaf on the ask of authoritarian governments.

Gatekeeper and app notarization went from something you could bypass to now a hard block on distributing your own software on MacOS without approval from Apple.

The centralized root of trust is what really turns me away from Apple these days. Why should I put my faith in the world's largest corporation? Are all my eggs safer in this basket? Is this one 'too big to fail' now?

Why wouldn't the reviewer note that the flagged image isn't CSAM?

Why would they? What is their motivation to do so?

I agree. I've been meaning to buy an Apple laptop to develop on for years now and constantly kept putting it off; first because of quality concerns that have no place in a device with such a price tag and now because of this.

If only there was a Linux-compatible laptop with specs similar to the M1. The only thing that comes to mind are Thinkpads and those things are ugly as hell.

Not really similar specs to M1, but: https://puri.sm/products/librem-14.

I use PureOS on old Macbook Air for casual browsing with Hardened Firefox and Emacs for RSS/Org-mode and it runs very smoothly.

Moved office to Arch/Manjaro, Win VM’s in isolation for design tasks.

M advancements of Apple are not so critical when considering cost per performance. There is no denying their advancements, but who knows what’s going on inside this architecture.

Some will say that I am overeating, but since reading Trusting trust (https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...) I shifted my mind towards Raptor Computers direction. The prices are high but paying for open hardware is smart investment in the current climate.

If you like security through isolation, I recommend to try https://qubes-os.org.

While not ARM powered, Framework laptops are worth a look and what I ultimately have moved to

Framework looks interesting, even though the CPU is not as good as the M1. Pity it's only available in the US.

Reply on news.ycombinator.com