Humorist2290

It is probably a reference to the report mentioned in this article from September https://reclaimthenet.org/germany-chat-control-false-reports...

  According to the Federal Criminal Police Office (BKA), 99,375 of the 205,728 reports forwarded by the US-based National Center for Missing and Exploited Children (NCMEC) were not criminally relevant, an error rate of 48.3%. This is a rise from 2023, when the number of false positives already stood at 90,950.

Indeed 50% false positive rate sounds surprisingly good, but this is under the "voluntary scheme" where Meta/Google/MS etc are not obligated to report. Notably missing from the article is the total number of scanned messages to get down to 200k reports. To my knowledge, since it's voluntary, they can also report only the very highest confidence detections. If the Danish regime were to impose reporting quotas the total number of reports would rise. And of course -- these are reports, not actually convictions.

Presumably the actual number of criminals caught by this would remain constant, so the FP rate would increase. Unless of course, the definition of criminal expands to keep the FP rate low...

  (6) Online child sexual abuse frequently involves the misuse of information society services offered in the Union by providers established in third countries. In order to ensure the effectiveness of the rules laid down in this Regulation and a level playing field within the internal market, those rules should apply to all providers, irrespective of their place of establishment or residence, that offer services in the Union, as evidenced by a substantial connection to the Union.

The article links to the text of the revised proposal. It reads like they're openly planning to push it again, and soon, and worldwide. The UK and EU seem to be setting aside their differences at least.

  But if you want to outlaw this harmful activity [licensed gambling], you have to find a way to replace 6.4% of Maryland’s budget, which is slightly less than the entire amount the state brings in from corporate taxes.

A fraction of the proceeds of losing bets from a fraction of Maryland's citizens contributes almost the same to state services -- EMS, education, road maintenance, etc -- than the total corporate taxes levied on all businesses.

Do I misunderstand, or is this just actually incredible?

In my opinion, AI-coding is basically gambling. The odds of getting a usable output are way better than piping from /dev/urandom/, but ultimately it's still a probabilistic output of whether what you want is in fact what you get. Pay for some tokens, pull the slots, and hopefully your RCE goes away.

The president is quoted as saying

  The White House Ballroom is being privately funded by many generous Patriots, Great American Companies, and, yours truly.

Whether that is credible, and whether there is an obligation of financial transparency, is apparently too politicized to dig deeper for The Guardian.

I can't disagree. Modern famine is a tool used to cause harm indiscriminately. It is a testament to the human capacity for cognitive dissonance that so many people can be against the starvation of children yet support politicians responsible for mass starvation.

Though my point was more about considering the historical context. Famines used to happen all the time but largely because of crop failures. That famine is _caused_ has become common knowledge is, I think, at least an improvement. ~All~ Most of the famines that could've happened for the old reasons haven't.

Admittedly, I'm grasping at straws to avoid dwelling on the horrid situation at hand.

So focusing on the details of the situation in Gaza is quite awful. The general tone of the comments in this thread, along with basically any public forum I think speaks for the reverberation of human suffering throughout this -- civilians are being made into casualties, Israeli and Palestinian, and it's terrible.

Taking a broader perspective, large parts of the human race have come to realize famine is a relic of the past. Modern agriculture, synthetic fertilizer, and the technology of the last 100+ years has made famine optional. There is without a doubt the technological capacity to supply every person on earth with food and clean water. Nobody needs to go hungry to feed every person in Gaza. The same could be said of Sudan, or Bangladesh, or Haiti.

200 years ago, famine was usually a natural disaster; now it is almost exclusively a political choice.

Then Israel severely limiting the amount of food is helping Hamas by artificially, and cruelly, limiting supply. People want to feed their families and will go to great lengths: sell their valuables, harm others, or wait in line at a Gaza Health Ministry site with the knowledge the IDF might fire into the crowd.

If they flooded Gaza with food then Hamas would benefit less from the supposed stealing/reselling.

I still don't really understand this story. I know that ICE invaded the factory and detained a few hundred people. They were vanished away and presumably being speedily sent back to Korea. Sure.

But every article I've read on this makes no statement about whether any of these hundreds of people were actually working without an appropriate visa, or whether they were given the chance to demonstrate their legitimacy, or whether any of these hundreds of people got to defend their case to a judge. Shouting "I'm here legally" while being rounded up by LEOs is not due process.

I'm not particularly sympathetic to Hyundai here, and it wouldn't be surprising if they subcontracted a sublegal operation to cut costs. But in a group of a few hundred people it's quite hard to imagine none of them have cases even worth hearing.

That's exactly my point though. Google, AWS, Meta etc all stand to gain from this. But plenty of middle tier providers are entirely silent even if it poses a potentially existential threat. Some people are going to get rich from this of course, but many will be ruined.

And that's before even accounting for the lives to be destroyed by a blurry photo of a tree being classified as abuse material.

Sure, but the way this was written it also includes everything from Gmail to root access servers hosted by Hetzner. Gmail has been doing this for years, but (I assume) not Hetzner. If even hosting providers are dragged into this the scale grows dramatically. Can Hetzner really not even be bothered about having to comply with such ridiculous requirements?

To give a simple example: imagine a script that constantly dumps /dev/urandom into JPG-like files nonstop onto a 16 TB disk, then repeats. I've seen enterprise systems that aren't so dissimilar. If indeed the EU commission wants all files scanned, then will Hetzner need to spy on all of their machines at least enough to check for compliance? I'm guessing their board members think it can't possibly be so dumb, or stand to gain handsomely and privately.

From Patrick Brewer's analysis [0] it seems like written into the proposal is to enable members of the government to have access to excepted systems, if applied for things like law enforcement or "national security." If I had to guess, at least a few MEPs expect they will be able to use such an exemption for their personal communications.

[0] https://www.patrick-breyer.de/en/posts/chat-control/

> Chat Control would make it mandatory for all service providers (text messaging, email, social media, cloud storage, hosting services, etc.) to scan all communications and all files (including end-to-end encrypted ones), in order to supposedly detect whatever the government deems "abusive material."

I wonder why there has been such silence on this, with the exception of a handful of well written blog posts. The scope of such a dragnet, the economic impact, the societal damage, all seems rather broad. Yet why don't any major operators in the EU take a stance? Is it really so below the radar, or being kept so below the radar?

Just the network egress costs to whatever state sanctioned scanner gets built will in aggregate probably exceed a few hundred MEUR yearly.

I mean multiple VPSs for redundancy. Contabo is maybe the cheapest I've seen and it's like 3$ mtl for the smallest?

Yeah they can be cheap, but I would definitely recommend having at least 3 for redundancy. If one get shut down or it's IP blacklisted you still hopefully have a backup line to create a replacement.

And using another VPN like NordVPN or ProtonVPN is probably in the same category as Mullvad, but worth being cautious. If it's free, you are the product. If you pay, you're still sending your traffic to a publicly (usually) known server of a VPN. That metadata alone in some jurisdictions can still put you in danger.

Stay safe

- Tor. Pros: Reasonably user friendly and easy to get online, strong anonymity, free. Cons: a common target for censorship, not very fast, exit nodes are basically universally distrusted by websites.

- Tailscale with Mullvad exit nodes. Pros: little setup but not more than installing and configuring a program, faster than Got, very versatile. Cons: deep packet inspection can probably identify your traffic is using Mullvad, costs some money.

- Your own VPSs with Wireguard/Tailscale. Pros: max control, you control how fast you want it, you can share with people you care about (and are willing to support). Cons: the admin effort isn't huge but requires some skill, cost is flexible but probably 20-30$ per month minimum in hosting.

So "certified" Android devices are phasing out side loading, making Google Play the only way to install an app. This is the norm on iOS, right? And in many jurisdictions, from Russia to Denmark, there is an actively hostile, and rapid, legislative push to prevent or criminalize using E2E messaging apps like Signal.

How long is it until we see countries pushing to just delist Telegram, Signal, etc from the app stores?

If you're an American and want to vent your frustrations, you could try the US Capitol switchboard (202) 224-3121 .

You can contact your senator and ask how they are contributing to the safety and prosperity of Americans, or just human beings in general.

Sometimes this is possible, but generally VPNs are illegal (at least that's what I was told) in Russia. The government has become increasingly active in identifying and locking users out of them, and of course users risk being dragged into the Russian criminal system.

Doing some sort of SSH tunnel to a VPS hosted elsewhere might work, might not. Plain old wireguard might work, might not. Consumer tools for technically novice users seem to be the government's priority.

I don't doubt it's well validated, and the point of it also is clear. Based on the questions I could appreciate exactly your point -- people with some mixture of traumatic experiences will score higher, people without (or with fewer) will score lower. I imagine, as a total laymen in this field, the intended application is surveying large groups to focus resources, or perhaps as intake material.

But sharing and comparing scores on an internet forum seems (to me, as a laymen) outside of the test's design purpose. Initially I thought I would share my experiences here, but like mentioned in other comments -- I just don't want to breathe life into any of that. I hope other people who participated in the discussion found catharsis at least.

Fully agreed. The oversimplification of the scoring system feels deeply wrong.

In practice, I imagine it would be in the minority of cases when law enforcement is given a report on someone including this detection "evidence," and for the duration of the investigation the child is placed in protective custody. Not necessarily permanently, however the experience of family separation even for a few days can be traumatic. Criminal investigations can often take more than a few days of course.

At the same time, there are unfortunately many counterexamples of abusive parents not being separated from their children via the same mechanisms. Sometimes this is from the abusers being "good criminals" and not getting caught; but sometimes it's from LEOs being bad LEOs and not doing the catching.

My point was that in a system which surveils ~500M people, even an FP rate of ~0.01% is 50k people. Supposing the LEOs tasked with filtering this into credible (and triable) cases further manage to, through amazing police work, confirm the innocence of 99% of those false positives. That's still 500 falsely accused, but now confirmed suspicious, suspects.

I think, but mostly hope, that this client side scanning initiative will fall apart. Not just because it's an obvious destruction of civil liberties for us in the EU, but also because it's doomed to fail even if implemented. The underlying concept is ineffective at dealing with CSAM, or any kind of adversarial user scenario. Unfortunately my hopes have a bad legislative record.

Clients aren't trustworthy. Ignoring the myriad services that exist, and will come to exist, which just never implement this -- there will be (somewhat) easily accessible versions of apps that remove such telemetry. E.g. VScode is to VScodium as WhatsApp is to WhatsAppium.

Imagine the spoofing opportunities. Message someone, get their client ID, report that client detected all the worst CSAM imaginable.

Think of the false positives. Think of the expense. Think of the children. Think of the children whose non-abusive parents send banal but confounding photos to each other, get hounded by CSAM allegations, and some fraction of whom get separated from their child.

Passing this will be a huge expense of time all of these legislators could use better. Implementing these directives will be a huge expense of money and knowhow to build a flawed and exploitable system. Enforcing the consequences will have untold amounts of suffering unrelated to CSAM. And likely after the first few creeps are caught, the adversarial actors will just start using other channels.

But by that point the conversation will have shifted to clientside scanning of thoughts...

~120k base salary with another ~40k equity per annum. EU, mostly in office. 10 years exp. Nominally working 40 hours, but very relaxed and enjoyable.

My last post had a much better salary; +50% or so. The working hours were grueling though -- 60+ hour weeks often, and constantly putting out fires. I'm happy to have moved, even if it meant a big pay cut. Burn out isn't worth the extra money.