Hacker News Reader

Comment by helsinkiandrew | Hacker News Reader

> “We are concerned that the interoperability requirements of the DMA could force us to compromise the integrity of our products in ways that risk user privacy and data security,” Apple said in a statement.

Apart from the “security concerns” of allowing use of non Apple services it will be interesting to hear the specifics of these. I thought most AI features were being released in American English before other locales in 2025 anyway - this does sound like an excuse to get the public to put pressure on the EU

View on HN

> Apart from the “security concerns” of allowing use of non Apple services

I would think that if the EU requires Apple to allow third parties to use the new screen sharing APIs with the same privileges, that would be a security concern.

I kind of figure if I'm sharing a constant stream of screenshots of my screen with one company why not share them with every company? Might as well send it to the hackers too, I guess.

This way I can have more AIs analyzing my screen.

I'm pretty sure that SharePlay screensharing is encrypted like FaceTime is, so I don't think you're sharing that stream of screenshots with Apple by using it. Their concern would be that if you allow third parties to use that API, they might stream your screen elsewhere.

My jest was aimed at Siri's Apple Intelligence (AI) upcoming Onscreen Awareness. I'd like to also share my screenshots stream to be analyzed Microsoft AI's Copilot+ Recall feature for ultimate AI analysis and any other company that wants to send my screen to AI. Alphabet Intelligence? Sign my screen up!

Ok, that doesn't really work either, because the Apple Intelligence stuff is done on-device.

Dang, joke fail again.

If I can do AI on a computer in my pocket then why are we investing all of this money building AI Factories?

Apple announced many of the new features are not on-device. There are three categories:

1. On device

2. Private cloud compute (aka Apple’s servers)

3. OpenAI (but only if you approve each time it’s used)

This isn’t really a new thing - you could always tell that some of Apple’s AI features depending on remote servers by disconnecting from the internet, using Siri and seeing how much of it stopped working.

2 I guess you can argue; they say that's all encrypted and they're sharing the OS with security researchers to audit. 3 I don't think is applicable, OpenAI is not getting screenshots for awareness, they're just getting "I asked Siri 'write a limerick about the DMA,' Siri can't do that, can you do that?"

I find (2) to be kind of a BS narrative. It’s not like they are open-sourcing the code. All big tech companies have security audit programs. Does that assuage your security concerns when Google, Meta, etc do it? Basically, what they are saying is they are doing it on the backend and you should give them credit for doing it on the frontend because some security researchers are going to get a Disneyland tour.

Personally, I actually am somewhat encouraged that tech companies are subject to legal process (in the form of lawsuit discovery etc). Tech companies have paid billion-dollar settlements for allegedly breaking the laws in segments of their business that don’t generate billions in profits. Obviously there’s a lot of room for them to push the limits of the law, disagreement about what the law is, and there mays be ways for them to get away with things. But the fact that audits are happening, the code and logs can end up in court acts as some kind of constraint on their behavior.

> not like they are open-sourcing the code

“We’ll take the extraordinary step of making software images of every production build of PCC publicly available for security research. This promise, too, is an enforceable guarantee: user devices will be willing to send data only to PCC nodes that can cryptographically attest to running publicly listed software” [1].

[1] https://security.apple.com/blog/private-cloud-compute/

I don’t know if you’re joking but this is actually an amazing example of a very real organizational challenge: people get tired of dealing with edge cases, so they give up all together. I absolutely 100% trust Apple to do what it thinks is best for profits, and I don’t see any way that eroding/risking their privacy stance would pay off. Not to say “I don’t have anything to hide”, but I definitely don’t have any profitable to hide!

Joking! I'm not planning on sharing my screenshots stream with Alphabet/Apple/Meta/Microsoft Intelligence.

Besides how profitable will it be for AI to know that Ev's reloading HN again? And again and again and again.

Maybe we can get AI to serve me on onscreen ad!

Wait, screen sharing API, so its basically the same thing, that Microsoft tries to do with Recall?

Nah, their screen mirroring with Airplay is already open. They had remote desktop with the VNC protocol forever and that even isn't encrypted.

And it makes me wonder what they can get away with in other countries that they are afraid to try in the EU.

You’re thinking of the GDPR. Apple’s citing the regulatory requirements imposed by the DMA, which are written down but remain unclear because the EC would apparently prefer Apple to figure out the “spirit” of the law and comply with that instead.

Well, you can either try to comply with the spirit of the law and work with the EU to clarify, or you can maliciously comply with the letter and get fined.

I'm not a lawyer, but I didn't need to be one to see the 0.5 €/user/yr fee and think "yeeeeah that won't fly".

Or maybe Apple's legal team should hire me to advise on the spirit of the law.

Dude, malicious compliance is not a real legal term and if Apple is charged, it's going to be for non-compliance, because even if you comply "maliciously", if you are compliant, then you are compliant. Either the text of the law matters, or it really doesn't, but out of the institutions that form the government of the European Union, the EC is the one with exclusive legislative initiative; the EU Parliament doesn't write the laws it is asked to vote on, nor do they have the power to compel (only ask) the EC to write a law so if anyone within the EU can write what they mean into the text of a law since they're also the ones who will be enforcing it, it is exactly the European Commission. The EC seems convinced that Apple's reading of the text is just wrong, and most likely the dust won't settle on this until they take this to the CJEU.

Well, Apple says it complied, the EU says it didn't. If the letter of the law was the whole law, this would be objective, but apparently it isn't, since they're disagreeing. As you say, there is the "reading of the text", and yes, it probably needs the CJEU.

Yeah, unfortunately when there is a dispute in how the law should be read, it goes to the courts. I will say that Apple is at a massive disadvantage even if it's possible for them to win in court because I don't know exactly how the CJEU does things, but generally here in America, there is some debate in judicial philosophies between whether you follow the text, the text and nothing but the text of the law, if you follow the text and the original intent of Congress at the time that they wrote the text, or if you read into the intent of the text and what the text was trying to accomplish.

As far as original intent goes, the EC wrote it, and very recently. There won't be much of a debate if it comes down to that, but if the CJEU is inclined to go straight to the text and question the parties on that, Apple might actually have a decent shot at beating the EU in court, but then theoretically the EC can just rewrite the law and try again and there really isn't anyone that could stop them so… yeah.

Yeah, I don't see how this won't be a "well, if the law isn't 100% clear on what we want you to do, we'll rewrite it until it is" thing...

The EU is undergoing something of a regime change right now so it is possible this won’t just be one bad decade for Apple (and Google, Facebook, ByteDance, etc.), but odds are low.

It's pretty easy to see where they're coming from.

Apple's approach to AI integration draws a pretty clear line between the part that Apple controls and takes credit/blame for privacy of (i.e. on-device models and their private cloud system) and third-parties that require specific consent to send data to (ChatGPT).

If the EU decided that Apple has to allow their whole on-device and private cloud stack to be warning-less-ly swapped out for PII_GrabberGPT, NüdLeaker Pro, or ScamBot9000 if the user chooses it from a legally required randomized menu, then I can see why they would have rational concerns about user privacy.

The problem is not just about interoperability. According to DSA, given Apple is one of the designated companies, they are responsible for security and privacy while DMA mandates that they allow for interoperability when they add functionalities. It's a fundamental conflict and requires trade off. Apple is likely waiting for the current term to be over in november and then deal with the new regime. Vestager is called a waning star, and she has been most vocal about it in recent times.

> Apple is likely waiting for the current term to be over

I imagine they need the likes of Mistral to lobby for them. Being locked out of the richest billion people in the world’s phones structurally disadvantages the European AI sector.

Reply on news.ycombinator.com