Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Eric Rescorla <[e-mail]>]

On Tue, Dec 19, 2023 at 1:20 AM Eliot Lear <[e-mail]> wrote:

> Hi!
> On 18.12.2023 23:14, Eric Rescorla wrote:
>
>
> ISTM that this is an example of a setting in which we have a term of art
> which is used in a way somewhat different from its literal meaning.
>
> Specifically, it is very common right now to have clients of various kinds
> scan for material that the recipient doesn't want to receive, such as in
> the case of spam filtering, virus scanning, or Apple's sensitive content
> warning [0]. In many if not most of those cases, the operator of the device
> opted into or at least actively wants that kind of scanning. I think we can
> agree that this type of scanning works to some extent and isn't
> incompatible with open source or open protocols. This is, of course,
> scanning that happens on the client, and I believe it's what Brian is
> referring to.
>
> What the IAB statement is referring to is something different, which is to
> say scanning which is imposed upon the operator of the device whether they
> want it or not, and is designed to stop the operator from sending and
> receiving certain classes of content. As you note, it's common practice to
> refer to this and not the type of scanning in the previous paragraph as
> "client-side scanning" (in contract to "server-side scanning"), but it's
> really the mandatory part of it that makes it distinct from other cases in
> which scanning happens on the client.
>
>
> IAB statements are necessarily brief.  When they become lengthy, they have
> another vehicle: RFC.
>
Sure. This message was not intended to take sides on the IAB statement, but
merely to help clarify what seemed to be confusion about terminology.

-Ekr

With that in mind, there are clearly challenges in delineating in code the
> two cases you describe, as the interfaces that are used for one case could
> possibly be used for another; and that does strike me as intersecting the
> Internet Architecture.  I'm also confident that you have already blogged on
> this in detail ;-)
>
> Also, this discussion seems to indicate that at least some people are
> unsatisfied with the statement.  I think we should view that as an
> opportunity.  What needs to be further teased out and what should the venue
> for that teasing be?  Here?  A separate mailing list?  PEARG?  HRPC?  And
> how could the conversation best be facilitated?
>
> Eliot
>