[aesh2Xa1]

Your rebuttal is, at best, a specific, straw man instance of "If you were doing nothing wrong then you have nothing to hide."

I needn't be holding child pornography to be concerned about a third party viewing my photos, writing, or other media on a device that is just mine and not published, public content.

[mrzimmerman]

CSAM is a hash database. The images are converted to a hash and then compared to the hashes of known pornography of children, not directly viewed.

The weirdly less discussed aspect of this is that anyone who is storing their images of any kind on someone else’s computer and network thinks that nothing could have been viewed before. If Apple or Google or Amazon want to scan the data you store with them they could be doing it, so if that was a concern for a person from the get go then they wouldn’t have been storing their data with third parties to begin with.

[JohnFen]

> The images are converted to a hash and then compared to the hashes of known pornography of children, not directly viewed.

I honestly don't understand why this is a relevant point. It's still surveillance.

> that anyone who is storing their images of any kind on someone else’s computer and network thinks that nothing could have been viewed before

I don't think that's the confusion. I think a huge part of the issue is that the surveillance is not taking place on someone else's computer, it's taking place on your smartphone. Yes, Apple says it only happens if you're uploading to the cloud -- but that's just Apple saying "trust us". If they did the scanning on their computers instead of yours, it wouldn't be necessary to trust them on this point.

[mrzimmerman]

That’s true of any software you’d use anywhere if you accept the updates of the creator. Linus Torvalds could accept an update tomorrow that surveils people’s data and YES people might notice but plenty of people just accept updates and move on (if you’ve done code reviews you know how arduous multi-hundred or thousand line contributions can be to review).

My point is we've already been taking the same risks and the only reason it’s something now is because it’s a transparent process. It’s always a “trust us” scenario unless a person routinely scans all software they is and all updates for malicious server calls or some other kind of recording of data and maybe opening of a back door.