Hacker News Reader

Comment by 2pEXgD0fZ5cF | Hacker News Reader

I'm going to slightly modify and repeat comment of mine I wrote here on another post for the same topic:

According to the DKSB (Deutscher Kinderschutzbund) [1], encryption barely plays a role when it comes to the distribution of CSAM [2]. In short: DKSB is not in favour of this. You know, the people that probably know what they are talking about when it comes to the protection of children, unlike the politicians who are trying to force this through.

The politicians which only really talked to salesmen of surveillance software [3] about this and never really consulted any independent people with expertise in tech, privacy or the protection of children [4].

Because this was never, at any moment, about protecting children.

[1]: https://www.dksb.de/en/home/

[2]: https://www.eu-info.de/dpa-europaticker/316232.html

[3]: https://netzpolitik.org/2022/dude-wheres-my-privacy-how-a-ho...

[4]: https://edri.org/our-work/private-and-secure-communications-...

View on HN

You got it right. Lots of people here think this is some sort of big conspiracy by lizards to build a surveillance state. In truth, it is simply software companies that have surveillance products to sell lobbying the government.

Source: at my German uni there are many recruitment drives from these entities

Also, governments are used to being able listen into whatever they wanted to in the past, and now their capability is eroding, and they don't want to lose their apparatus.

e.g.: Crypto AG incident, old phone taps, etc.

So you think Zensursula is pushing surveillance state only so she can then buy surveillance products of US tech companies because ... what? Money going to her pocket?

I think that's much more of a conspiracy theory than the notion that politicians want control.

She is riding the lobbying wave without giving much critical thinking to what happens. After all, she is just a humble public servant, she thinks. What harm can this possibly make?

Why that surprises you?

As a German minister of defence, she is known as a person who paid half a billion euros to PwC consultants. Also, she renovated a sailing wooden training ship for more than 200 million euros.

And she is accused of removing proofs by deleting data from her phone and “not remembering” anything.

I would trust that person every evil and corrupt thing one can imagine.

Why is it so hard to believe she simply wants [Chat] Control, then?

She does, because she will benefit from it, even if only indirectly.

Of course, she wants Control, although not for control's sake, but because she will get more of what she really wants (money, power, more money, ...)

It's sad that our EU doesn't let any hope that they do something because they believe it's the right thing to do. It's always big business and foreign government interests before interests of Europeans.

Why is it so hard to believe that she truly thinks that McKinsey consultants will improve the German Army instead of guzzling money?

Sorry, I wrote PwC instead of McKinsey.

Now, if I only could make my previous comment disappear, like she made her messages disappear, so they couldn't be used as court evidence …

The biggest problem is Germany's and other Western European military is that they've been starved of money for decades.

Paying half a billion to consultants to tell you this is.... Kinda the problem.

Politicians want more than control, they want informational weapons.

It's clear now how these Israeli zero-day exploit software power politicians' informational armies against their political adversaries.

You are putting things in a manner that is too concrete. Politicians do not always need money that is going directly to their pockets.

UvdL has been mentioned in connection with nepotism before (by the German state radio!):

https://www.dw.com/en/german-opposition-to-probe-defense-min...

After that scandal she failed upwards to Brussels. Politicians that are that unassailable should face extended scrutiny. Who protects her and why?

(Here is an unrelated mask procurement scandal that shows how things work in Germany:

https://www.dw.com/en/german-mask-scandal-unforgivable-viola...)

History is chock full of people in positions of power pissing away all sources of resources and closing the door to all sorts of prosperity for both themselves and for the people subject to their actions in order to further consolidate power.

> ... simply ...

Might be an understatement?

So, yes she's misrepresenting things to her electorate, in order to bring in a load of surveillance. But please don't think she wants to spy on everyone, totalitarian style - no, no she's just being bribed (sorry, I meant "lobbied").

Sleep tight, eu.

I mean she probably doesn’t think about it that way, she’s probably never stepped back and noticed “we dont have the technology to either protect children or find CSAM” she probably never thought that and said “but I dont care!” and she definitely never thought “because it fulfills the totalitarian prophecy of The Order! >hissss<”

its not about bribery, its about being led on by the nearest grifter because everyone actually working on technology isnt in the same circles as the politicians

It's both. Don't be fooled it's only about money. It's clearly about money and control.

You're probably right that this is mostly software companies looking for revenue in the form of a forced purchase of a product through legislation.

But, keep in mind: the government is actively selling out its constituents and creating an environment that enables a surveillance state, even when that may not be the original goal. Slippery slope and all, first it's child pornography - but where does it stop? It won't, because that data set is rich to mine - rich to sell into. We can make up entire product lines that can be sold, via FUD, into our ignorant government friends and force people to buy it even when it's been shown to provide little to no value to the masses.

So, no - not a lizard conspiracy. More like "Dumb and Dumber: Government Edition".

Surveillance capitalism erodes expectations of privacy. Eroded expectations of privacy in turn normalize government surveillance. Normalized government surveillance erodes expectations of privacy, which in turn normalizes surveillance capitalism.

Incentives are aligned, each party acts in their own self interest and this is the outcome. Conspiracy isn't needed to explain it.

The fact that said lizards are not actually conspiring amongst themselves does not mean the lizards do not see furthering of the surveillance states as a convenient ancillary benefit.

People ascribe to government officials way too much competence and way too little desire to consolidate power and rule absolutely

Why are software companies lobbying for their products and politicians wanting to establish a larger surveillance state mutually exclusive?

Isn't that just a matter of interpretation and perspective? If surveillance wasn't attractive to governments and law enforcement, why would it be such an attractive market? Governments have massive need for software in general, but it's also no coincidence that they're consistently excited about surveillance, and particularly indiscriminate mass surveillance.

> big conspiracy by lizards to build a surveillance state. In truth, it is simply software companies that have surveillance products to sell lobbying the government.

The lizards may be behind the software companies though

Thinking about this from a more technical perspective. CSAM scanning will only catch the dumbest of abusers. One with even a remote level of sophistication will just spin up their own servers, there is plenty of OSS software out there to do such a thing, and thus would completely bypass any measures that are being proposed.

With services like Digital Ocean, you can spin up a chat server with pretty much only the most basic of technical knowledge, hell you likely won't even have to touch a command line.

Sure the EU could move to require OSS software developers operating in the EU to backdoor their software but that will be moot too as it will get caught on to in a heartbeat and a fork (sans backdoor) will be made available.

It will catch random webmasters.

In short, Dutch hoster TransIP had to pause their scanning service. They got hashes that included default images from WordPress.

"Waar het misging, is volgens TransIP-woordvoerder Marco Edelman dat per ongeluk hashes van standaardafbeeldingen van WordPress-installaties en plug-ins zijn toegevoegd." [1] https://tweakers.net/nieuws/182766/transip-pauzeert-hashchec...

With the high-likelihood of false positives, this is just another Child Benefits scandal waiting to happen if the system were to be completely unsupervised.

It uses the MD5 of the image, no surprise there that there were collisions with ordinary files. I've run into MD5 hash collisions causing mayhem several times in my life (usually between unrelated email addresses, IIRC).

You found 2 actual emails with the same md5? That sounds very unlikely. MD5 is weak against attack, but you're not going to be hitting collisions with "normal" data and especially not short strings.

Just looked over my notes. It was not email addresses, but a collision of two separate UPC codes concatenated with a timestamp. We never figured out which UPC codes it was or the timestamp (this was picking/sorting software for a warehouse in 2012). I wasn't there when it happened, and only heard about it after the fact (I was on my honeymoon). It crashed the software pretty hard.

That would be interesting since that would be likely the shortest known MD5 collisions. The shortest ones known are 512 bits differing by 2 bits.

If I had to guess, you might have been hitting collisions in a truncated MD5 hash. It's not uncommon to do something like take only the first 64 bits of the hash. Doing this you are quite vulnerable to birthday problem issues.

It was in php using the built-in md5 function. I’m actually reaching out to a friend that still has the code to see what the exact string is that got hashed.

I have no idea if the database is still somewhere, if so, we can look at the git commit and figure out what the possible UPCs are and narrow it down to a couple of hours worth of time stamps. I have a feeling it would probably be more than 512 bits though. UPCs are can be longish, plus a time stamp with each digit being a byte…

I highly doubt the database exists in any meaningful way though, since the product was shut down years ago.

What's so worrying about this is that these stock images were added there in the first place. Clearly the process is completely broken, if there was any kind of human oversight this would have been caught right there.

Right now it was clear because it was an often-used package. What if it's something more niche next time?

You're right! I think, to protect the children, maybe we should require licensing to run servers?

Here's how it works. By law, all machines will require networking, or will refuse to boot.

Network stacks will require a key / license. Licence will be verified by an online server, continually, and any OS without this will be fined, and the devs implementing a bypass jailed.

Stop complaining/pointing out flaws, or you must hate children! Or... are you one of them?

All machines require networking or refuse to boot? That's quite a solution...

I know that HN policy is to take the best faith interpretation, but I'm really struggling here. The ramifications of what you suggested are boggling to consider- any developer of any system must implement and require a network at the lowest of levels... That would be impossible to enforce, and a nightmare to implement. Secondly, theres still nothing to prevent dark networks from emerging. Once its out there, its out there. Key/license servers would be even more of a target for corruption, exploits, and circumvention than encryption servers, with all of the same problems we see currently. In no world is this possible, never mind livable. It would be Orwellian to even imagine.

I believe it's meant to be read as sarcasm.

Surely you jest but truth be told this is the direction I have been watching companies move albeit slowly and carefully.

Microsoft are slowly baking in this concept into Windows 10/11 to become more like an XBox at least for the home version. I envision a future version of windows will operate very closely to the method you described. I suspect all of the OS vendors want an app store in front of everyone whenever possible and telemetry to see what needs tuning to keep interaction with the app store as high as attainable. I do not believe it would be a stretch to see a future home version of windows not allow login if their authentication servers can not be reached or if ones cached remote credentials expire.

I could even see this eventually happening with Linux. The latest version of the Fedora desktop F36 interacts heavily with admin.fedoraproject.org and they have an app store. AFAIK Redhat/IBM have not yet implemented any centralized authentication servers with corresponding default client configurations to utilize them and I do not know if they intend to.

> I could even see this eventually happening with Linux. The latest version of the Fedora desktop F36 interacts heavily with admin.fedoraproject.org and they have an app store. AFAIK Redhat/IBM have not yet implemented any centralized authentication servers with corresponding default client configurations to utilize them and I do not know if they intend to.

I disagree. It might happen to some flavors of Linux like Fedora, Ubuntu and others that are backed by companies. But because the source is open, there will always be distributions that do not have such a restriction.

I agree with you. My personal hope is that the smaller distributions do not garner enough attention and the big companies leave them alone while at the same time having enough community developers keeping them alive and not infiltrated by developers that want to drive people to the corporate distros.

There are far too many distros out there. There are hundreds if not thousands listed on DistroWatch

Governments might make it illegal to run these "dangerous" unsupervised OSes though. Or what could happen is that your bank, government website etc fails to work "for your protection" because your machine fails attestation. This is something that's already being done on Android with SafetyNet, albeit with apps instead of websites.

In addition the EU is also working on an online ID so a website can request your real identity and verify it. This would link in with that, validate the user as well as their hardware.

Right now? No. But I could see it happen in 10 years. Especially once CSAM is no longer the scapegoat and they have admitted they want the data for a lot more surveillance. I can already see the posts of people that think they have nothing to hide.

Yeah iOS already doesn't let you activate if you have no network connection of any kind. As well as having a closed app store.

The desktop OSes are heading there too but they're still a bit afraid of pissing off their legacy users. Besides the lock-in they're all aiming at that sweet 30% app store commission.

>CSAM scanning will only catch the dumbest of abusers.

Why isn't that better than catching none of the abusers?

It's a balance of issues.

These measures are only likely to lead to the arrest of a small portion of abusers, while opening a massive avenue for government overreach across the entire population.

I would assume that very few to none of us on here are pedophiles, and we're aware this is going on. It stands to reason that the pedophiles are also aware that this is going on, and the vast majority of them are going to adjust their behavior to avoid this scanning. Doubly so once a few arrests are made.

The balance of those issues is subjective, though.

Exactly. A handful of actual abusers will be caught and the rest will change their methods. The rest of us will have a system looking over our shoulder for the rest of our lives with an ever-expanding scope of uses. Not exactly a great trade-off.

The same reason using napalm to cut down on weeds in your backyard is probably unwise.

I would like law enforcement to use the tools they have now before they beg for more tools to (ab)use.

If only it caught abusers, it would be great. Just think about what kids do while teenagers, throw in some poor judgement. Kids being kids. Is it a good thing that there should be a system in place to "catch" this? To involve strangers in their most intimate and vulnerable private communique?

That's just one argument on "even if everything works exactly as intended, it's still a terrible idea".

Then add malicious use of such a system once in place. We know such systems are misused ALL the time. So I would bet good money that someone, somewhere, will instead use it to neatly collect CSAM material.

Not to mention other malicious use of surveillance whereby you just add some hashes for files completely unrelated to CSAM. I'm not talking about the slippery-slope of "let's include some gay porn in the mix", but rather stuff related to political opponents, and what not.

It's a false dichotomy to suggest the trade-off is "catch some abusers" vs "catch no abusers". It's a "catch some abusers" vs "violate privacy of minors | remove e2e encrypted communication | etc"

I'm usually on the fence between gross incompetence and straight out deception as the cause for these proposals, but in this case I'm convinced of the latter.

History is replete with those who preach morality and act otherwise.

With the mandate from Heaven out of fashion in most (ahem, one glaring example) democracies, there is always think of the Children.

Really makes me wonder how many millions Ashton Kutcher would make pushing for this, he seems to have found the best regulatory capture since SawStop to push for this

But I agree with the parent comment, the vast, vast majority of distributors doesn't know how to work with encryption. The audience here knows, but compared to the average user, the audience here has much more technical knowledge.

Generally I agree with everything you said. There is a subtle and important distinction here though. Encryption rarely plays a role in the distribution of CSAM, yes, but a more concerning part in my mind is the role encryption plays in the active abuse of children.

To be very clear, I think there are ways to design applications around encryption to prevent the active abuse on platforms. For example, disabling encryption on minors accounts, limiting messages from people outside of your social circle, allowing opt-in so parents can read messages from their kids, AI models to display a prompt to the child that something may be harmful and they should seek their parents etc.

The biggest disappointment I had with Apple about this CSAM scanning business, is that they were not talking about or taking steps in preventing the active abuse of children. I would love to see regulation put in for the design of apps when a minor uses them. A small part of me is worried about poor regulations, but then we have things like Kik.

You don't understand how CSAM scanning works. This requires well known hashes of pedophiliac content - meaning it will do nothing for a novel exploitation of a child.

You can also just have your kid not use encrypted apps or not allow them to message internet strangers. That is probably the wrong thing to do - blanket bans are a bad way to teach life skills - bit you as a parent can do so. You don't need government help.

Some of what you are suggesting is exactly what Apple has said that they are implementing in iMessage for child accounts. In particular, the AI notifications to children that the message that they are receiving or sending may contain csam and that they should reconsider.

Reply on news.ycombinator.com