321–330 of 1001 posts
Earlier quoted context omitted.
"asking users about every single minor feature is (a) incredibly annoying" Then why lie and mislead customers that your data stays local?
I don't think that's a fair characterization of what they're doing.
Apple patting itself on the back.
Earlier quoted context omitted.
Because the conclusion is not workable. Almost every single app today interacts with the network in some way. You would be constantly annoying the user with prompt after prompt if you wanted to get consent for sending any relatively harmless data off the device.
It's telling that Android, for example, has all sorts of granular permissions you can set for an app, but "Network Access" is not one of them. My Calculator app does not need to call home. A good portion of the apps I use fall into this category, and a straightforward mechanism to opt them out of access would be welcome.
Earlier quoted context omitted.
What would be the value to the user in your scenario? In the photos app real scenario, it’s to enable a search feature that requires pairing photos with data not on the phone. (I understand you’re being sarcastic.)
Maybe we can do some analysis and optimize phone battery life based on your cohorts usage patterns. I don't know, I'm sure we'll figure something out once we have your data!
What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first . All of that work to try to make this feature plausibly private is cool engineering work, and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in. Trust in software will continue to erode until software stops treating end users and their data…
Software will continue to spy on people so long as it is not technically prohibited or banned.
So basically - You take a picture. Apple encrypts it and uploads it to their server. The server matches the (still encrypted) picture to a database and tells your device "this picture contains the Eiffel Tower". Later when you search for Eiffel Tower on your device the photo pops up. Is the complexity and security risk really worth it for such a niche feature? It's also funny that Apple is simultaneously saying "don'…
Not really. It's more like apple runs a local algorithm that takes your picture of the Eiffel tower, and outputs some text "Eiffel tower, person smiling", and then encrypts that text and sends it securely to apples servers to help you when you perform a search.
Locally, a small ML model identifies potential POIs in an image.
Another model turns these regions into a series of numbers (a vector) that represent the image. For instance, one number might correlate with how "skyscraper-like" the image is. (We don't actually know the definition of each dimension of the vector, but we can turn an image that we know is the eiffel tower into a vector, and measure how closely our reference image and our sample image are located)
The thing is, we aren't storing this database with the vectors of all known locations on our phone. We could send the vector we made on device off to Apple's servers. The vector is lossy, after all, so apple wouldn't have the image. If we did this, however, apple would know that we have an image of the eiffel tower.
So, this is the magic part. The device encrypts the vector using a private key known only to it, then sends this unreadable vector off to the server. Somehow, using Homomorphic Encryption and other processes I do not understand, mathematical operations like cosine similarity can be applied to this encrypted vector without reading the actual contents of the vector. Each one of these operations changes the value, which is still encrypted, but we do not know how the value changed.
I don't know if this is exactly what Apple does, I think they have more efficient ways, but theoretically what you could do is apply each row in your database to this encrypted value, in such a way that the encrypted value becomes the name of the POI of the best match, or otherwise junk is appended (completely changing the encrypted value) Again, the server has not read the encrypted value, it does not know which row won out. Only the client will know when it decrypts the new value.
"I don't understand most of the technical details of Apple's blog post" I do: - Client side vectorization: the photo is processed locally, preparing a non-reversible vector representation before sending (think semantic hash). - Differential privacy: a decent amount of noise is added the the vector before sending it. Enough to make it impossible to reverse lookup the vector. The noise level here is ε = 0.8, which is q…
> This is what a good privacy story looks like. What a good privacy story looks like is that my photos aren’t sent anywhere in any way shape or form without explicit opt in permission.
I'm moving my family out of apple photos, self hosted options have come a long way. I landed on immich [0] and a caddy plugin that allows for PKI certificate for account access while still allowing public shared URLs [1]* There's also LibrePhotos which is packed with features but doesn't have as much polish as immich. They do however have a list of python libraries that can be used for offline/local inference for thi…
Earlier quoted context omitted.
The OP is evidence. My phone had it turned on which I think is evidence. Together this feels like reasonably strong evidence but maybe something even stronger is easy to find. Vaguely related: https://markxu.com/strong-evidence
I think both of you had it turned on from past OS installs - it's bundled under other search metadata, the config isn't new to 18. And "it's on and I don't remember agreeing" is absolutely not evidence. This is super common - nobody remembers what they enabled a year ago.
It's a brand new feature of iOS 18 and macOS 15. It did not exist in iOS 17 or macOS 14.
Moreover, my macOS 15 volume was a totally fresh, clean install on a test Mac.
Let’s step back and go through the thought process of the team that’s implementing this feature. If they leave the feature disabled by default most likely casual users will never use it because they won’t be able to find the setting buried under all the menus. Thus after adding all their privacy layers the team felt that it should be safe enough to enable by default while remaining true to the company’s ethos of priv…
Earlier quoted context omitted.
> I don't want anything sent from MY device without my consent Then don’t run someone else’s software on your device. It’s not your software, you are merely a licensee. Don’t delude yourself that you are morally entitled to absolute control over it. The only way to have absolute control over software is with an RMS style obsession with Free software.
They might not be legally entitled to it, but that's just because of our shitty "intellectual property" laws. Morally speaking, OP is absolutely entitled to have a device that they own not spying on them.
Want a phone that doesn’t spy on you? Make it yourself. If you can’t, find some like-minded people and incentivise them (with money or otherwise) to make it for you. If they can’t (or won’t) perhaps contemplate the possibility that large capitalist enterprises might be the only practical way to develop some products.