Hacker News Reader

Comment by gruturo | Hacker News Reader

> "Scanning every user’s privately stored iCloud data would create new threat vectors for data thieves to find and exploit"

> "It would also inject the potential for a slippery slope of unintended consequences. Scanning for one type of content, for instance, opens the door for bulk surveillance and could create a desire to search other encrypted messaging systems across content types."

Yes, and it was patently obvious from the onset. Why did it take a massive public backlash to actually reason about this? Can we get a promise that future initiatives will be evaluated a bit more critically before crap like this bubbles to the top again? Come on you DO hire bright people, what's your actual problem here?

View on HN

I want to be clear that I agree with you and I am not providing this explanation as an excuse for Apple, but merely as an explanation for what might have happened with the timeline: first they announced they were doing this, a bunch of us said "no this is the first step towards breaking e2e entirely", and THEN this year there was the high-profile issue--note that I am not saying it is a new issue, but merely that it was suddenly a high-profile one that actually caused a lot of press and backlash--with the laws in the UK and/or Australia or whatever that showed we were all correct, and so I'd guess even the most ardent "I am smarter than everyone" person at Apple finally went "ah damn I was wrong".

being smartest person in the room is neutered by working in the dumbest room in the building.

> and THEN this year there was the high-profile issue with the laws in the UK and/or Australia or whatever that showed we were all correct

Do you have a link to that issue? I didn't heard about it (I'm from a third world country)

No, as I didn't even know which country it was from for sure, right? ;P But I went ahead and typed "UK encryption" into the Hacker News search and it all popped up from the last few months; the first hit, from a month ago, was even about Apple actively scrambling to push back on it (lending even more support to my point).

https://news.ycombinator.com/item?id=36800297

This is truly mind-boggling because it’s Apple and such an important topic. We are right to expect better from these bright people.

It worries me that Sarah Gardner seems to be truthful when she hints at that no one at Apple reached out to her after Apple killed the plan in December 2022. She must have also missed articles like the one at The Verge [1].

Gardner’s message to Tim is dated 2023-08-30 03:24:37 (CEST).

Erik Neuenschwander's reply was printed out 2023-08-31 14:41:00 (probably PDT).

So that’s a period of about 44 hours that the print out [0] represents.

It would be helpful to know the time when Apple’s reply was sent to deduce whether Apple had time for additional deliberations before writing the email to Gardner.

Regardless, as reported by The Verge they obviously had deliberations shortly after the public outcry, killed the plan in December 2022, and then presumably failed to inform Gardner about the reasons.

If that’s the case, far smaller companies have checks and balances in place to keep that from happening.

[0]: https://s3.documentcloud.org/documents/23933180/apple-letter...

[1]: https://www.theverge.com/2022/12/9/23500838/apple-csam-plans...

>It would be helpful to know the time when Apple’s reply was sent to deduce whether Apple had time for additional deliberations before writing the email to Gardner.

In the old days, and I assume it is still the case, judging from observing Apple for the past 20+ years, every single public response has to go through Apple PR. Even public interview before hand they were given lots of preparation.

It is likely Apple has this prepped for a long time. Or even it was another PR case scenario [1] where the CEO was baited to send this email before a response was given and somehow "leaks" to the press.

[1] Read Submarine PR by Paul Graham.

Apple was concerned about governments using the excuse of CSAM to pass laws which would force Apple to weaken encryption across the board.

Whether this was the right response to such concern is something I’m not unsympathetic towards. Certainly I think it’s reasonable to say that Apple was trying to thread a needle in a way which was never going to please everyone, even if it somehow turns out to have been the least-worst outcome.

Yes, but to OP's point: this was patently obvious from the onset. Even here the comments at the time [1] pointed to all sorts of potential misuse, political or religious prosecution, dystopian cases of false positives, and that this would leave the door open to future government escalation beyond CSAM.

How could they not see that they would have a giant backlash on their hands? Did they overestimate their ability to get away with the "it's for our children" excuse this badly?"

[1] https://news.ycombinator.com/item?id=28068741

I think Apple was doing the exact opposite. They wanted to do the __least possible thing__ in order to stave away the far worse outcome of intelligence departments using the "it's for our children" excuse to pressure elected representatives to vote for back doors on consumer encryption.

The ridiculous thing is that Apple's proposal was functionally identical to what other platform vendors (e.g. Google, Microsoft) were already doing. In all cases — including Apple's proposed system — only photos uploaded to cloud storage would be scanned to see if it matched CSAM already known to the government. The only difference with Apple's proposal was initial "fuzzy hash" calculation would be performed on-device prior to upload, instead of on-cloud after upload.

The reason for doing it differently was because it meant (in theory) satisfying both masters — implementing real end-to-end encryption, while not being seen as a CSAM scanning laggard compared to Google, Microsoft, etc.

Other vendors just scan all your shit and nobody cares.

Signal and Meta (WhatsApp) don’t scan your messages. Apple’s actions have shown they are untrustworthy, and even if they’ve reversed this particular decision, compromising on principle has put authoritarians on notice they are open to compromise in the future, like the UK’s horrific Online Safety Bill.

Pointing out a few app vendors simply isn't impressive. Of course some app vendors can take a stand against mid-tier governments. It's great marketing for them, and the corporate risk isn't so high. It's the platform vendors which have much at stake.

And of the three big platform vendors, two of them already scan private photos for CSAM right now — Google and Microsoft. Yet nobody is outraged because nobody actually cares. There's no logical consistency. Google and Microsoft can implement scanning and there's no outrage. Apple went to great lengths to tell everyone exactly what they were proposing to do before they did it, and all the online people are outraged and calling Apple untrustworthy. Sure, whatever.

Neither Google nor Microsoft operate a secure messaging platform that matters (email, yes, but email security is a lost cause), unlike WhatsApp (and Facebook Messenger), iMessage, Telegram or Signal. I'm not giving Google & Microsoft a pass, they're just irrelevant for the discussion at hand.

The CSAM scanning Apple abandoned, ie the topic at hand, was for the cloud, like the one operated by Google or Microsoft. You switched the topic to secure messaging platforms, which are irrelevant for the discussion at hand.

Why are Google and Microsoft irrelevant to this discussion? Please, be specific.

Wholesale scanning of private data is unaaceptable, and the fact you engage in such mental gymnastics to justify it is a sign that everyone should be distrusting any platform by default. Simple as.

Enjoy the exodus.

Your first sentence makes no sense. Perhaps you meant to say: "Wholesale scanning of private data is unacceptable therefore everyone should be distrusting any platform by default." That's a statement I would agree with.

I reject the claim of "mental gymnastics" as a meme bereft of substance, and specifically in this instance, as an unproven hypothesis. But even if I granted the inference, I don't see how overly elaborate argumentation could have any explanatory power for the trustworthiness (or otherwise) of major platforms.

I'm curious, why do you think I'm advocating trust in any platform? And I'm curious why you think that I have any concern one way or another for an "exodus" from any platform?

Really, I'm just replying to say that while I think I understand the gist of the tone of your reply, I don't actually understand anything you wrote. And my hope is that you can clarify, because — and I say this with all sincerity — I really am genuinely curious.

> How could they not see that they would have a giant backlash on their hands? Did they overestimate their ability to get away with the "it's for our children" excuse this badly?"

I imagine it wasn't an environment where one could argue those concerns on fair grounds without it being seen as enabling CSAM and shot down. I also imagine it's enticing to call their competitors' products "pedo-phones".

So how come there is no public backlash against Microsoft and Google who scan your cloud pictures in the cloud, enabling political and religious persecution, dystopian cases of false positives, and future government escalation?

Apple had a bunch of technical obfuscation that may have convinced them that they'd engineered their way out of a tough spot. "Your scientists were so preoccupied with whether they could, they didn't stop to think if they should."

When it was made public people shot all sorts of holes both in the technical mechanisms themselves as well as their insufficiency even if they all worked as intended.

We should have some sympathy-- they did have some neat technology. But neat technology isn't enough.

>what's your actual problem here?

Post Steve Jobs Apple, especially after Scott Forstall and Katie Cotton left. ( Along with a few other top executives) Tim Cook's Apple were left with people of Harmony. These left aligning, DEI focus people have the same characteristic, their way is for the force of good, hence their way is the only way. Same as early Google in the 00s. ( Privacy is a fundamental human right? Actively securing and promoting Chinese components in their supply chains. )

I am sure CSAM started with good intention. As with most ideals do. But fundamentally they don't work in this complex world.

All roads to hell are paved with good intention.

I hope there are still enough of Steve Jobs' conviction left inside Apple.

Well said

> Tim Cook's Apple were left with people of Harmony. These left aligning, DEI focus people have the same characteristic, their way is for the force of good, hence their way is the only way.

Ironic that this opinion is just a reductive and reactionary as the thing that it decries.

Reply on news.ycombinator.com