Apple wants to implement features that access data locally. It doesn’t want to allow competition for offering those features, but if it did, competitors may use that access to local data to exfiltrate.
So it is about both competition and, as a result of creating competition, privacy.
This allows competition, but also allows privacy for those who want it. See? Simple really, but Apple being Apple dont want to let 3rd parties use its AI APIs and so we have this standoff.
Someone might believe that people who ignore the warnings deserve everything they get, but I respectfully disagree. I remember helping my grandma uninstall and remove all the hostile browser extensions that had tricked her into installing them. If Apple is protecting vulnerable populations by taking the choice out of the users hands, even if it’s only profit motivated, I’m okay with that until someone presents an alternative that actually addresses those needs.
If you want to you could still use Apple or another provider you decide to trust - or even one that does everything locally. The competition would still have to follow GDPR after all.
Will the EU enforce the same for 3rd party integrations?
If Apple extended that philosophy to other vendors then yeah, it would be deliberately unfair and anticompetitive.
Even if you could make all the other possible vendors run private cloud compute style stuff that would be a lot to manage.
And I can’t imagine the EU would like, and as a user I would certainly hate, the “OK you can use Grok but you lose all privacy too bad“ dialogue box they could make.
Most sysadmins know that hash matching only mitigates a small subset of rare upstream attacks. Apple could still be MITMing the whole thing (SSL added and removed here :)) and no auditor would get the chance to check. The offered audit is so weak that I would not trust any FAANG business to administrate it.
Apple is once again demanding arbitrary centralization to give them an undeserved veto power. None of this is for security.
Just have an open house for anyone interested to come poke the hardware and software?
By the sound of it, Apple's offered audit doesn't include insight into the most dangerous parts of a system like this. This could easily lead to a situation where real security experts are denied access to promote influencer-adjacent Yes Men who rubberstamp the hashes matching without any question.
Hence my concern for "SSL added and removed here" - none of Google's famously backdoored infrastructure will be audited. For privacy purposes, Apple's promise is woefully incomplete.
So if they did that here, I doubt the EU would accept it. And even if they did as soon as a competitor of any side/credibility cried foul I’m sure the EU would make life very hard for Apple to prove they’re not being unfair in even the tiniest way.
How I understood it that they want _actual_ security researchers, not some random dude who once installed Kali Linux and ran nmap.
It's state of the art private compute according to actual experts and everyone will be wasting their time if the "researchers" need to be coached through the process and explained the basics of the system's operation.