Hacker News Reader

Comment by shishy | Hacker News Reader

> In short, Apple has built a CSAM detector that sits at the doorway between your device and iCloud. If you don’t sync photos with iCloud, the detector never runs.

Is this correct? I have just read conflicting things about this online, I think even Ben Thompson wrote that it runs on the device too?

View on HN

Both statements are correct--for now. It runs locally on device for photos synced to iCloud. Presumably it's a slow boil: they'll make it run on all photos in a year or so, once the press from this one has blown over.

Thanks (to you and the other responders) for clarifying; that makes sense.

Bit of a shame... I wish it just sat elsewhere on their server before cloud syncing and then I could just disable cloud sync + use the phone without worrying.

There's the rub. I think folks would feel better about if Apple-owned equipment was doing the scanning, even though arguably it is worse for privacy.

> Presumably it's a slow boil: they'll make it run on all photos in a year or so, once the press from this one has blown over.

What is the basis for this assumption?

History....

But this move matches Apple's current stance on backups. They have access to iCloud backups, but do not have access to local ones. This has been the case for a while now. This mirrors the situation with iCloud photos. In other words, maintaining the privacy of non-synced photos would be consistent with their previous stance on local backups.

It is correct, but it’s also true that it runs on the device. It’s actually an interesting trade-off as it’s more private in some ways, at the cost of potentially being less private if misused in the future.

Wait if this is really true, why are people freaking out? Wasn't Apple already scanning photos uploaded to iCloud? And now it just happens on-device?

No they were only scanning iCloud email. They were lagging well behind other services in identifying this content, only finding a few hundred compared to millions by Facebook for example.

The system only works with iCloud Photo Library, it needs a server side component to continue the process.

https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

This is a very interesting read and personally I think they’ve gone to extreme length to make this system as private as it could be.

It doesn't matter what the first version does. They will not stop there ... Russia started with "protecting children" too... look what they do now 10 years later. Imagine what they will demand from Apple with such capabilities. And Apply will most likely cooperate ...

" The authorities are now moving not just to reduce the influence of foreign tech companies but also to force them to promote Russian services — as with the new regulation mandating government-approved apps on all new smartphones.

Apple has agreed to this "

https://time.com/5951834/russia-control-internet/

> look what they do now 10 years later

Care to elaborate? I am genuinely curious

>... In 2012, Russia began blacklisting and forcing offline websites with the purported goal of protecting minors from harmful sites ...

> Government critics have been targeted; Navalny’s Live Journal blog, which published investigations about corruption in Russian politics, and other political opposition sites were blocked. (Roskomnadzor said they were banned for calling on people to illegally participate in mass events).

>The “sovereign Internet” law required Internet Service Providers (ISPs) to install Deep Packet Inspection (DPI) equipment, which has been used by some countries, like China, for censorship. DPI equipment enables Russia to circumvent providers, automatically block content the government has banned and reroute internet traffic.

>It has required search engines, including Google, to delete some results...

>some have buckled under Roskomnadzor’s threats to block them if they don’t comply with censorship orders. In 2018, Facebook-owned Instagram, which has 54 million users in Russia, complied with the regulator’s requests to remove posts connected to corruption allegations by Navalny. In a tweet Navalny accused Instagram of submitting to “illegal censorship orders”. “Shame on you Instagram!” he wrote.

>After Roskomnadzor threatened to prosecute social media sites for encouraging minors to join the January protests, the regulator said TikTok deleted 38% of its related content, while YouTube and Russian social media site VKontakte removed half.

All from the link I've provided above already in the previous post: https://time.com/5951834/russia-control-internet/

Thanks; I missed that link.

The statement about DPI is wrong though: DPI is ineffective without government-mandated root CAs.

Yeah they are wording that poorly, it’s definitely on the device. This article feels like the most charitable read of CSAM.

Reply on news.ycombinator.com