Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Eric Rescorla <[e-mail]>]

I'm no fan of Apple (or indeed any OS vendor) restricting which code users
can run, and of course iOS is even more restrictive. However, I'm also not
on the IAB, so I'm not sure why this message is in response to me.

-Ekr



On Tue, Dec 19, 2023 at 1:13 AM Vittorio Bertola <
[e-mail]> wrote:

>
>
> Il 18/12/2023 23:14 CET Eric Rescorla <[e-mail]> ha scritto:
>
> ISTM that this is an example of a setting in which we have a term of art
> which is used in a way somewhat different from its literal meaning.
>
> Specifically, it is very common right now to have clients of various kinds
> scan for material that the recipient doesn't want to receive, such as in
> the case of spam filtering, virus scanning, or Apple's sensitive content
> warning [0]. In many if not most of those cases, the operator of the device
> opted into or at least actively wants that kind of scanning. I think we can
> agree that this type of scanning works to some extent and isn't
> incompatible with open source or open protocols. This is, of course,
> scanning that happens on the client, and I believe it's what Brian is
> referring to.
>
> What the IAB statement is referring to is something different, which is to
> say scanning which is imposed upon the operator of the device whether they
> want it or not, and is designed to stop the operator from sending and
> receiving certain classes of content.
>
> Great! So, could the IAB please tell Apple to stop preventing me from
> running on my MacBook Pro executables that didn't go through their app
> store or vetting process? A few days ago I tried to run "rar" via command
> line after getting it via Homebrew, and my laptop simply refused to do so
> because rar's developer isn't a friend of Apple, and in the end I had to go
> through a seven click process at the third level of the computer's settings
> just to be able to run rar. I never asked for this check, but apparently
> there is no way, not even a cumbersome one, to disable it permanently.
>
> Somehow, however, this kind of client-side scanning and blocking of
> content "imposed upon the operator of the device whether they want it or
> not" does not seem to be a problem for the IAB, but blocking CSAM is.
>
> --
>
> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
> [e-mail]
> Office @ Via Treviso 12, 10144 Torino, Italy
>
>