If that was the case they'd just implement it on their own servers, just like everybody else (it's not like iCloud is E2EE).

In reality they probably have a "photoscanner.so / .dylib" that currently is only linked in by the iCloud uploader thing, but at any time could be called in by any other part of the system (or offer exploits new avenues for data exfiltration), which was actually spelled out in their initial announcement (there will be a system API for accessing it).

So they absolutely have the ability to scan photos on your phone; the fact that they don't intend to currently use it outside of the iCloud uploader is totally immaterial to this debate (the thing I don't want on my phone is photoscanner.so or any such capability).

> which was actually spelled out in their initial announcement (there will be a system API for accessing it).

That is completely false. They announced, a week after the initial announcement, that the on-device nudity-detection they planned on implementing in iMessage would also be open to Snapchat and other messaging apps. That doesn't report anything to the police, isn't hash-based, and is done on-device; it just pops up a bypassable warning to allow child users who are part of "iCloud Family Sharing" to avoid seeing things they don't want to see. It has nothing to do with CSAM detection.

I continue to be frustrated by the amount of misinformation on the anti-CSAM scanning side of the debate, including on HN (and it's orders of magnitude worse everywhere else).

At any time they could implement a new feature in iPhone to do anything, yes that's true, and yes they could be flat out lying that this is how it's implemented. They could be lying about the whole thing. If they'd implemented it on their servers, they could still have taken that code and later put it on their phones and run it on whatever photos they liked.

Come on, now you're really going off the rails. What we're discussing here is the system Apple has said they have implemented and described. Anything beyond that is hearsay and accusation, for which some evidence would be appreciated. If you're just going to believe whatever you want to, and damn the evidence or what anyone says, go ahead. There's nothing much more to say.

I think that they can do that is the problem, though? If you don’t like the way Google is running things, you can swap out the OS on your Pixel for one of several open source privacy-focused Android forks. But if Apple does something to iOS you don’t like, you’re stuck with it.

That's got nothing to do with CSAM, or this change and isn't anything new. If we're going full tinfoil, Android manufacturers could force update, lock down or brick your Android phone any time they like anyway. If you allow remote updates, which I think we generally all want for security updates, it's all about trust.