Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

Vittorio Bertola <vittorio.bertola@open-xchange.com> Tue, 19 December 2023 09:13 UTC

Date: Tue, 19 Dec 2023 10:13:40 +0100
From: Vittorio Bertola <vittorio.bertola@open-xchange.com>
To: Eric Rescorla <ekr@rtfm.com>
Cc: Andrew Campling <andrew.campling@419.consulting>, "architecture-discuss@ietf.org" <architecture-discuss@ietf.org>, "iab@iab.org" <iab@iab.org>
Message-ID: <74692684.138702.1702977220127@appsuite-gw2.open-xchange.com>
In-Reply-To: <CABcZeBNQBw6tiW4+JSB_8J=si2ewzZfOaSxX0eU=UrMhDv+O2A@mail.gmail.com>
References: <170266952162.33107.14325064798861197261@ietfa.amsl.com> <6.2.5.6.2.20231216110256.18d0acd0@elandnews.com> <CWXP265MB5153610FBB98A7B06AF81040C290A@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <CAKr6gn2Hf4N+DgKHKyO+i3T3OJyYRBJhH1AdQf-uXZ0xKmJ4Eg@mail.gmail.com> <CWXP265MB515381523714FF99524410CFC290A@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <790032a6-24f6-60d1-fb60-4b44bd447bde@gmail.com> <fadd9250-4b31-4bf5-aa76-4f37d24fd650@cdt.org> <CABcZeBNQBw6tiW4+JSB_8J=si2ewzZfOaSxX0eU=UrMhDv+O2A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_138700_572276459.1702977220113"
Importance: Normal
Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1
Archived-At: <https://mailarchive.ietf.org/arch/msg/architecture-discuss/3VXU4oGw39mtYv04_oGZMZXYVRQ>
Subject: Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content
Precedence: list

 

> Il 18/12/2023 23:14 CET Eric Rescorla <ekr@rtfm.com> ha scritto:
>  
> ISTM that this is an example of a setting in which we have a term of art which is used in a way somewhat different from its literal meaning.
>  
> Specifically, it is very common right now to have clients of various kinds scan for material that the recipient doesn't want to receive, such as in the case of spam filtering, virus scanning, or Apple's sensitive content warning [0]. In many if not most of those cases, the operator of the device opted into or at least actively wants that kind of scanning. I think we can agree that this type of scanning works to some extent and isn't incompatible with open source or open protocols. This is, of course, scanning that happens on the client, and I believe it's what Brian is referring to.
>  
> What the IAB statement is referring to is something different, which is to say scanning which is imposed upon the operator of the device whether they want it or not, and is designed to stop the operator from sending and receiving certain classes of content.
> 
Great! So, could the IAB please tell Apple to stop preventing me from running on my MacBook Pro executables that didn't go through their app store or vetting process? A few days ago I tried to run "rar" via command line after getting it via Homebrew, and my laptop simply refused to do so because rar's developer isn't a friend of Apple, and in the end I had to go through a seven click process at the third level of the computer's settings just to be able to run rar. I never asked for this check, but apparently there is no way, not even a cumbersome one, to disable it permanently.
 
Somehow, however, this kind of client-side scanning and blocking of content "imposed upon the operator of the device whether they want it or not" does not seem to be a problem for the IAB, but blocking CSAM is.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… George Michaelson
Re: [arch-d] IAB Statement on Encryption and Mand… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Vittorio Bertola
Re: [arch-d] IAB Statement on Encryption and Mand… Christian Huitema
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
Re: [arch-d] IAB Statement on Encryption and Mand… Andrew Campling
Re: [arch-d] IAB Statement on Encryption and Mand… Andrew Campling
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Wes Hardaker
Re: [arch-d] IAB Statement on Encryption and Mand… Hesham ElBakoury
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… Eliot Lear
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
[arch-d] Off topic [was: IAB Statement on Encrypt… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
Re: [arch-d] IAB Statement on Encryption and Mand… Arnaud Taddei
Re: [arch-d] Off topic [was: IAB Statement on Enc… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] [EXTERNAL] Re: IAB Statement on Encr… Tommy Jensen
Re: [arch-d] Off topic [was: IAB Statement on Enc… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] IAB Statement on Encryption and Mand… Adrian Farrel
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] Off topic [was: IAB Statement on Enc… Hesham ElBakoury
Re: [arch-d] Off topic [was: IAB Statement on Enc… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Vittorio Bertola
Re: [arch-d] IAB Statement on Encryption and Mand… John Levine
Re: [arch-d] IAB Statement on Encryption and Mand… Mirja Kuehlewind (IETF)
Re: [arch-d] [IAB] IAB Statement on Encryption an… Mirja Kuehlewind (IETF)