It's even better in Russian: доверяй, но проверяй, doveryay no proveryay
It's better because it displays both words are semantically related. In fact, "verify" is cognate with their root, vera/veryat', probably a common Indoeuropean root but I'm too lazy to verify (pun intended).
The latest desktop and mobile OSes are quietly shipping code to enable this, despite the uproar that happened when Apple announced it. They let people believe they were stopping the project, but it nonetheless proceeds quietly.
Apple is not trustworthy.
https://en.m.wikipedia.org/wiki/MacOS_Monterey
(Edit for clarity: enable above is used in the "to support" sense. I do not know if such clientside scanning is enabled (in the activated sense) yet, only that Apple has explicitly stated at least twice that it will be. It appears imminent. Some or all of the code has already shipped and is on your machine(s).)
Why should I trust your declarations?
(linked from the above-linked wikipedia article as citation for the clientside scanning feature documentation on wikipedia)
https://web.archive.org/web/20210903214920/https://www.apple...
Apple said they were doing it.
Apple never subsequently said they were not doing it. (They did say some things that implied that they MIGHT not do it, designed to make you stop being mad at them ("Based on feedback from customers, advocacy groups, researchers, and others, we have decided to take additional time over the coming months to collect input and make improvements before releasing these critically important child safety features.").)
They did, however, reiterate that this was going to be released.
What more evidence do you want than the vendor's direct affirmative statements?
When people plainly tell you who they are: believe them.
If you don’t have the signature, it won’t do anything.
I’m a privacy advocate, and this approach actually increased my trust as it was a more palatable option than allowing unfettered server side access in response to LEO requests (which happens in extreme cases, but not on a routine basis.)
Privacy includes privacy to break the law until and unless specific probable cause is established in a court. Companies have no moral or legal obligation to get involved in mass scanning to enable proactive law enforcement. "But the children!" does not make this not a privacy violation. Signatures don't make this not a privacy violation.
The system is also ripe for abuse. What happens when the legislature mandates a regulatory body be able to set policy to amend the signature list?
You do not want to live in the world this creates.
This is not about child safety. Think more along the lines of Tiananmen Tank Man.
The topic is local scanning on an end user device without the consent of the device owner.
Clientside scanning of files given over to the cloud is nonsensical. Apple already scans serverside.
No evidence at all.
So I reiterate: Why should I believe you?
Please don’t reiterate obtuse questions when reasonable answers were delivered on a silver platter.
I'm not moving the goal posts. I'm asking him if he has any evidence that this app is for CSAM detection. So far, I've yet to see any.
Apple is within their rights to scan files on their servers. They already do this now, as you note. This thread is about something else: Apple OS bundled malware that scans files on non-Apple-owned machines without consent, even files that have not left the user's own device. This turns your own local hardware into a snitch against your will. What it scans for is also not within your control.
They do not do this today, but they have stated at least twice that they intend to begin.
It's completely relevant to my point because it's unlikely they'd be doing this without the pressure from US politicians.
There's also a lot of speculation that it's happening device side so that E2E encryption can be enabled for uploads.
E2E encryption that leaks information to the middle device about what data is being encrypted is not E2E encrypted.
It's backdoored.
Any system that can't be used safely by child pornographers for safety from government surveillance cannot be used safely by other groups that the government does not wish to operate. Those groups will (without any convictions) be labeled "violent domestic terrorists" by Apple and the FBI when their in-group memes are added to the clientside scanning signature list.
This is the bright line. It's your computer and data, not theirs.
Companies need to comply with the law. This is not law! Backroom pressure to deny millions due process is not reasonable, democratic, or conducive to preserving human rights. It has no basis in law, it is how dictators operate.
If Apple is breaking current law, charge them. If they are not, stop pressuring them, or maybe try to pass a law to alter their behavior (with associated public debate), like civilized adults do.
"Beautiful company you have there, Tim Apple. Shame if something were to happen to it if you don't help us spy on your billions of users." is about as undemocratic and authoritarian as you can get.
Apple trying to sugarcoat the anti-customer malware they're potentially getting strongarmed into rolling out is just as morally repugnant.
When a judge issues a search warrant, the accused has legal rights that dictate what is and is not probable cause. No such due process will exist with what is or is not added to the content detection signature list, everyone on the platform is deemed worthy of suspicion and is searched. The ML algorithm will declare you guilty based on a list of hashes, the inputs for which you are not allowed to possess or see (but somehow NCMEC is). There is no additional step before guys with machine guns raid your house and steal every phone and computer in it.
This is an end run around human rights to due process.
Not OP, but I'll throw my two cents in. While some people on HN were hyperventilating about the CSAM thing, I was digging into the docs to see what was actually happening. In every instance, I found myself a bit more impressed with how much engineering the folks at Apple clearly put into making it work without compromising privacy. Contrary to what people kept saying here on HN. It made me a lot more suspicious of randos on HN and a bit more willing to give Apple the benefit of the doubt.
I'm always amenable to more actual evidence, but as of yet that seems completely lacking. If I were more conspiracy minded I'd wonder if there was an orchestrated effort.
This is an authoritarian, tyrannical end run around basic human rights to due process, and if indeed it is an essential prerequisite (per the government) to Apple deploying e2e crypto, then we don't actually have freedom of expression (as Apple would presumably be punished by the federal government for publishing software that supports e2e encryption WITHOUT such literal spyware).
The fact that this is even being discussed is a giant blinking red warning light about the lack of freedom in our society. Both for millions like us, who want the availability of quality tools that don't work against our personal interests and human rights, as well as Apple, who appears to not be allowed to publish software unless it contains backdoors for the cops.
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
That should worry you a lot.
PS: Any clientside scanning whatsoever that the user did not consent to, that reports its results to a remote party (even if only positives) is a privacy violation. You cannot scan local files in any way whatsoever (for a purpose that is explicitly against the user, that is, reporting on suspected illegal activity) without compromising privacy, even if Apple's system works perfectly as described. Clientside nonconsensual scanning is inherently a privacy violation.