Most HN crowd presumable isn't actually worried about CSAM detection itself - its the local-side scanning where you lose control over your own hardware.
That CF tool is voluntary, it does not run automatically. Also, I haven't seen many people argue that CSAM scanning shouldn't happen on online cloud services. On local devices though? Massively over the red line.
That's why we shouldn't call it scanning for CSAM. We should call it mandatory submission of all private communication to government inspection. Fighting CSAM is just the alleged, first, use-case.
Every cloud provider does CSAM scanning or they'll be chased down by certain three letter gov agencies and/or US senators looking to score easy political points.
I'm incredibly amused by the number of supposedly deeply technical and informed people on this site who seem to be unaware of CSAM scanning and its existing use on cloud services.
The actual problem is that they've created a great surveillance tool which will inevitably get broader capabilities and they are normalising client-side data scanning (we need to eradicate terrorism, now we need to eradicate human trafficking, and now we need to eradicate tax evasion, oh, we forgot about gay russians, hmm, what about Winnie memes?).
Shutting down this new type of scanning is not the same as no longer scanning for CSAM.
It's curious how the big providers have been scanning for CSAM for YEARS with nothing making the news...because hashes are much different and don't false positive like this.
reply