Posts by doublelayer

Apple stalls CSAM auto-scan on devices after 'feedback' from everyone on Earth

Re: Hey Apple!

"So you'd rather they go along with what every other cloud company already does and scan it on the server side without explicitly making users aware that's what's happening?"

Over on-device, yes. Because then I can decide not to upload things and they don't run their scanner. Although an end-to-end encrypted backup would be even nicer.

"Further, I understand that there was never anything stopping any government from handing Apple on-device scanning code and forcing them to adopt it for sales to continue in that area—or even just passing a law requiring that device makers do it themselves. The idea that literally the only thing preventing this has been Apple not developing on-device scanning is absolutely absurd."

No, it's not. There is either code running on the device or not. If it's not, and the government mandates it, we can do what we want to about this. We could try to block the law. Or change the law. Or find a legal reason such a law is not permitted, which works better in countries with constitutional privacy systems but could also be enforced under human rights treaties. Or not buy any new equipment. If it's Apple doing it without any law, we have no control over it at all and moreover, no knowledge of how they're using it.

Re: It's true.

Or on the door of their local office, with the locks changed. There are very few organizations that stand in the way of autocratic orders and set up their systems to facilitate doing so. Apple isn't one of them. Their record is better than some others, but far from perfect.

Lenovo pops up tips on its tablets. And by tips, Lenovo means: Unacceptable ads

Technical attack, technical defense

I wonder what the network traffic looks like for getting this "tip" information onto each victim, and particularly what happens when the part that needs to download the largest assets crashes most of the way through. I wonder how they would react to a bot pretending to be an unstable app which continually tries and fails to download their ad, especially if multiple devices started to have trouble with the downloads all day long.

Preinstalled adware is entirely unacceptable on any hardware unless it is stated prominently at the time of purchase, and I wouldn't mind if that were banned too.

US Air Force chief software officer quits after launching Hellfire missile of a LinkedIn post at his former bosses

I'm not sure about that. Sour grapes to me would be if he was fired and sent this, but he was unhappy enough to quit of his own accord. That implies that, whatever the reasons, it's not something done to fire back at the person who took his job.

As for a good boss or an informed one, a bad informed boss is certainly a problem, but in many ways an uninformed good boss is too. A good boss who doesn't know how things work might, in good faith, make promises about things that can't get done. They might pass every decision down to someone who knows what they're doing and harm organization. While a somewhat informed good boss will definitely beat a bad one, good management requires some basic level of knowledge of what the people below you are doing. Someone who lacks that knowledge is likely to be ineffective or problematic without needing managerial incompetence as well.

A speech recognition app goes into a bar. Speak up if you’ve heard it already

Re: Sharp

I have come to the conclusion that some cheap low-power electronics are magical. Sure, they will refuse to run if there aren't some batteries in the slot, but the device doesn't actually use them once you put them in because they will run for years. I want to meet the people who designed such things and ask how they managed to get so much efficiency in their electricity use, presumably requiring quite a bit of engineering time, while also building the thing out of really flimsy plastic. Unfortunately, once I've realized that it's functioned correctly for eight years on a pair of AAA batteries, they're nowhere to be found.

Banned: The 1,170 words you can't use with GitHub Copilot

Any interest, though

Does anyone want this? I admit I don't like auto-completion basically at all (it annoys me when the editor tries to close my parentheses). I understand, though, why suggesting function names and showing parameters could be useful. Trying to predict the end to your statements, though, seems to me to be likely useless and definitely annoying. It's not as if you don't know how you're ending a line you've already started writing, so if it guesses right, at best you save a little bit of typing. It's also likely to guess wrong at least sometimes.

If anyone reading this wants such a feature, I'd like to know why.

Re: Usage

You'll just have to type the names out yourself. It might not even have guessed at that point that you're going to be naming countries anyway, even if it does see the word country, because there are a lot of contexts in which country could appear where individual names don't. But if it happens to guess right, it still won't suggest it. I'm sure you'll be fine.

Facebook: Let us tell you WhatsApp – we don't want to pay that €225m GDPR fine

Re: Law enforcement

I didn't see that as a commentary on all Irish people, but instead on the DPC. As the protection authority with the most power for most large tech companies, it has taken relatively few actions, those actions have been small, and they take a rather long time to get started. Given that Ireland is the European home for these tech companies primarily for tax reasons, it has an incentive to keep them there and competition for that desire, both of which can be helped by lax regulation. Whether that is deliberate or the DPC is just ponderous about enforcement, the desire for it to go faster is widely held.

NSA: We 'don't know when or even if' a quantum computer will ever be able to break today's public-key encryption

Re: Misdirection Again (Why am I not surprised?)

".....so it DOES NOT HURT if the algorithm is hard to identify....does it?"

It does hurt if you made any mistakes because nobody else tested for whether you had a clue what you were doing. If you are infallible in designing encryption, which is unlikely, it provides a mild benefit the strength of which depends on the resources of the attacker. But we've had that discussion before, so I'll stop now.

Re: See if the NSA asks for funding for such a computer

Only if they did it wrong. If you have a quantum computer and you want to use crypto to earn money, there's more to gain by finding wallets that haven't spent money in a long time and cracking their private keys. That gives you money without making it obvious that a lot more mining is being done.

Children of China, your state-sanctioned hour of gaming begins … now!

Re: "The spokesperson named Chess, Go, and programming as games"

Yes, it involves the same actions as playing the game, but with a specific goal in mind. You're not playing for the challenge of it, but instead looking for things which don't go as you thought they would. It can be fun to do, but it's done for testing, not for pure entertainment. Programming is not a game, even if you're testing a game you wrote. After you're finished finding the bugs, if your own game is captivating enough for you to play, then it's a game.

You may be wrong there. The games being banned are multiplayer games, in which communication with others is important. You have to make plans with your team members, which involves writing quickly and in an understandable way and may involve other languages for an international game. I don't know how often that is as I don't play any, but you do use language when playing multiplayer games.

In my opinion, only point 1 has any relevance. The others, well, let's look at each one:

"2) People playing online to absurd extents do not possess the basic level of social skills that were accepted as a norm 20 years ago and appear increasingly incapable of communicating, relating to or functioning in society."

Right. I've heard this before. About a lot of different things. I've heard that complaint about the television generation, the console game generation, the internet generation, and people who do lots of other things which are less generational but also involve spending a ton of time doing one activity (for example, reading books a lot and yes, I have heard people say it). We seem to be mostly fine. There are some people who lack social skills, but it's a stretch to blame that on some piece of mostly unrelated technology.

"3) All other forms of media break taboos to shock the audience and are having to get more and more extreme to shock people. People are getting increasingly desensitised and people argue that there is a correlation or causation with people then doing these things themselves."

I don't care. I also don't think it's true. I haven't really seen media as a whole getting more shocking. Certain types were more tightly regulated and now can be more shocking, but there's plenty of media out there which would have been just as acceptable a few decades ago. In each case, you decide what you want to consume and you read or watch what's out there. And people have been trying to prove that violent movies/television/games promotes violent behavior for decades (two for games, more for the others) and the research is still inconclusive. Continue to believe it if you like, but to justify regulation, you're going to need better evidence than that.

Re: Freedom vs public health

"We also need to be wary of those people who espouse freedom -- loudly -- while all the time pushing for laws that restrict others' freedoms."

I entirely agree with that sentiment, however it is of absolutely no relevance here. Those talking about freedom in this topic are calling for this to remain a private decision.

Regulating games based on their content, E.G. those which are gambling, is one thing that more will agree with, but you've still got it backwards. The first step would be to restrict the amount of gambling available based on society's preferences, not to restrict the time spent but allowing any level. The Chinese law doesn't do anything regarding gambling in games, and restricts all games equally.

Your arguments, while more likely to get support, do not apply to the situation under discussion.

And how about any of the other things children do for entertainment? How about reading books for fun (popular ones, not the classics or textbooks)? How about building things with toys? How about making up arbitrary games with their friends and playing those? In each case, the activity could cause problems if done too much, and at first glance the activity doesn't benefit the child much. Also in each case, the child actually does get benefits and it is a perfectly normal way for them to spend their spare time.

Forcing children to do nothing but work or learn is likely to burn them out. Restrictions should be imposed based on the child's activities and success rate, and if they happen to want to play a game on Wednesday, it's not automatically unhealthy.

I don't play games much (the odd puzzle or word game, perhaps ten minutes per week on average), and the closest thing to social media I do is posting here. So as someone who already doesn't want to do those things, what reason should democratic countries have for banning them? Usually, things are banned because they have a negative consequence on others, but looking stupid online where we can all ignore them doesn't reach that level for me. If you don't want your children playing games, feel free to place restrictions on them, but I can't think of a reason to impose your will on everyone else.

Logitech Bolt devices support secure Bluetooth Low Energy – but forget the 'Unifying Receiver'

Re: All I can listen

It's also encrypted, so no. The hopping is a minor advantage to throw off a basic listener, but the encryption is the important bit.

Rumors of satellite-comms-capable iPhone abound. The truth could be rather boring

Re: Starlink Debunked

"Literally no one can compete with them on base cost to deploy."

It depends who you count as their competitors. Geosynchronous satellite is the primary competitor for coverage where ground cable isn't available, and they absolutely can compete on price, not by having cheaper launches, but by having not very many of them. Launches for 42000 LEO satellites is more expensive than launches for 10 geosynchronous ones.

Re: Starlink Debunked

Ok, I decided to see what this was about. While the presenter is clearly biased against Starlink, the points raised aren't wrong. Here's a summary for those who don't want to watch:

1. It will be expensive to send up so many satellites and sell the equipment at a loss, so the predictions for revenue are very optimistic. This isn't really a surprise for a Musk company.

2. Starlink is worse than fiber service. Duh.

3. Starlink has worse bandwidth and better latency than geosynchronous satellite. Duh.

4. It clutters up the orbit. If you didn't know this already, you weren't paying attention. This leads to problems for land-based astronomy, future launches, and other users.

5. Failed satellites haven't automatically fallen like they were supposed to.

These points put together don't "debunk" Starlink; that was a poorly chosen name. They raise valid objections to it, most of which are well-known already. When you consider them in the context of the article, the only change is to slightly weaken the first objection--if they manage to get phone service over their satellites, that adds another set of possible subscribers which could make more money and make their revenue targets more reasonable (although it's still Musk, so don't expect it to be perfect now).

No, that wouldn't work. The authoritarian governments would require that satellite comms companies disclose customer information to them in compliance with local laws. If the company refuses to do that, the government bans payments to them. Only those few with bank accounts outside the country or who manage to exchange cash for service through someone who does can use the service. Because so few can use the service, the phones aren't widely sold in the country.

If the government wants to go further, they require that any phone with the feature is locked down to the satellite providers which comply or ban them outright. Buying or possessing one which doesn't comply with that regulation becomes a crime. Detecting those who have them can be done with a cheap radio surveillance device. Satellite may work everywhere, but it doesn't prevent dictators from dictating.

Adding AI to everything won't make sense until we can use it for anything

Re: We have AI

If innovation is your wish, it's been done before. Robots instructed to perform actions and doing them in unexpected ways because it decided how to do it without instruction. For example using an object that isn't a hammer to pound in a nail, even though a hammer was present. Was this intelligent because it improvised, dumb because it should have used a hammer, or inconclusive because it didn't know what a hammer was and chose a policy which, while not optimal, got the goal accomplished?

The question for the "AI is impossible/we have never seen it" people remains: what does a computer need to do to convince you it is intelligent in some way, keeping in mind that you can be intelligent in one thing without knowing everything else there is to know.

Happy birthday, Linux: From a bedroom project to billions of devices in 30 years

Re: I've got a suggestion...

Given the discussion at hand, neither of our opinions are moot though both are unimportant. You claim your organization "logical", I don't think so. It's not a thing that can be proven either way, so it's just arguing over what we like.

Re: I've got a suggestion...

I'll admit the organization you decided to use does sound like a nightmare to me. If you really have files that only differ by capitalization, then you're relying on everybody understanding what the capitalization means. I, at least, would not. If presented with a folder containing update_database.sh and Update_database.sh, which weren't identical, I would have no clue what the difference was and would be very cautious about which one I used. When you could be much clearer about this (update_database_local_user.sh and update_database_all_users.sh or, better yet, one script which takes a parameter to select which set of users you're running on), the capitalization doesn't sound like the best method.

Apple settles antitrust case with developers, but it's far from an Epic resolution to App Store monopoly concerns

Re: I get why change is necessary

It's a little different, namely that you can choose which stores to sell to based on those prices, sell directly using your own online or retail, or do both simultaneously. And of course because the stores frequently provide benefits and take on some risks, depending on the item and the relationship. Apple doesn't do either of those.

South Korea may ban Apple, Google from forcing store payment systems on app devs

"Will alternative stores have to pay for iOS and Android development, support etc. as well?"

No.

"Will they contribute to the cost of supplying free apps?"

No.

Just like the existing ones. Apple develops IOS, and it doesn't get the right to tax any user of that operating system. It decides how much to sell the hardware for. It decides when to cut people off of software updates. It could, if it wanted, charge for software updates like it did ten years ago. Just because they spend money on something doesn't mean that I am obliged to pay for it.

What's the top programming language? It's not JavaScript but Python, says IEEE survey

All of the above. And for each item in your list, it does it sort of fine and has a good reason to be designed like that.

It's not like some scripting languages I could name which, if used to implement any complex logic become unreadable above a hundred lines. It's not like some programming languages which require the creation of tons of unnecessary constructs when the programmer really wants to automate some simple set of actions. And it can easily wrap C libraries, abstracting out those peculiarities of C which make writing everything in it difficult (string parsing, anyone) while keeping its speed advantages for the intensive bits.

There is a lot to complain about when criticizing Python, but you have in fact named one of its strengths.

Singapore is the only nation with a dedicated 'net link to China. And they've just agreed to expand its use

Yes. Although they also have a satellite connection for some people. Most people with computers use the internal intranet and don't have any access, which saves on the number of guards you have to put there.

Robots don't smoke, says Alibaba, and that's why they deliver parcels so fast

Re: Awaiting the day

Unless you're doing both kinds of delivery and you get to select which, you've just moved the complaint to those who live at the bottom who would not like to walk up that many stairs to collect their package from the roof.

There are other problems, too. How about places where the roof has snow on it in the winter? How does a drone deal with that? Do the residents have to climb up and remove the snow frequently? How does a multi-occupant building work? Do the packages all go to the same place and people just work out who gets what? If the building does make separate receptacles for each resident, how does the drone identify which one to use? How would the system be paid for and standardized? How would it be added to older buildings?

Re: Doesn't seem safe yet

<pedant>That works out to one accident in a million deliveries, or one every fifty days</pedant> if you accept that rate, which I don't. There's no way they got enough information to estimate that number to that precision, and likely they have little evidence to estimate it at all. I'm sure it hasn't made a million deliveries yet, so the only way they're not lying is if it has so far had zero accidents. If it is, they don't know how likely it is to have accidents. They also state this number as if it has meaning without characterizing any of the necessary details, such as the environment necessary to get that level. I guarantee that it will have a lot more accidents in the winter in northern China than in the summer, in the sandy areas of western China than in paved ones not near sources of abrasives, and in lightly trafficked areas than in dense cities with plenty of available collisions. Yet they don't mention anything of the kind at all.

Re: Sooo

I'd like to see them try it on mine. That place was a robot's nightmare. Steps everywhere, never even, pathways intermittently blocked with vehicles, very steep pathways, snow and ice at some points, and ground made of whatever the builders had access to at the time including uneven bricks. They also hadn't completed their wheel chair accessibility requirements either, which would make things even harder. If they want to use these in real deliveries, they're going to need to deal with a lot of that stuff. I have a feeling it's a lot like Amazon's drones, which got tested with some hype and a lot of protests but never really got used.

Poly Network says it's got pretty much all of that $610m in stolen crypto-coins back

Yes, that's all true, but they still tend to pursue criminals who kept things over criminals who, in the long term, got nothing. Doing otherwise runs the risk of hung for a penny, hung for a pound, as well as costing extra in police time. I'm happy if they still pursue him, but there are reasons to doubt whether they will.

Re: Frozen by Tether

"Trivial to remotely freeze."

That describes Tether, but does not describe most other cryptocurrencies. You should investigate how Tether works--it's very different from most other ones and there's a lot to complain about in it. Some of your points are intrinsic to most existing cryptocurrencies, whereas others are remediated by design decisions. As I'm not really an adherent, my defense will stop there.

China puts continuous consent at the center of data protection law

Re: The Why, The What

The why is to have additional measures for penalizing tech companies who don't do what China wants. Usually, that's actually anti-privacy measures such as having pseudonymous or anonymous interactions, encrypting anything, not having records to provide to the police, etc. The letter of the law is very nice though. Like GDPR but with a few extra features which aren't bad. If only they did this because they believed in that.

Having trouble getting your mitts on that Raspberry Pi? You aren't alone

"I still can't see why people can't just spin up a virtual machine for that."

A few reasons. First, there's the complexity. For someone who doesn't know much about computing already, getting a VM to work correctly with everything else can be confusing. If you're running a server on a VM, then you need to know where the VM's network connection is and how it's currently connected to the computer's one, then bridge them properly so packets can reach the VM through the computer, then correctly configure both the host's firewall and the VM's. That's confusing for someone unfamiliar with network administration.

Second, I mentioned the uptime as a benefit of the Pi. If a child has access to a Pi and a laptop, and they have a project which involves having a server, daemon, or anything similar operating at all times, the Pi makes that easy and the laptop does not. Adding a VM to the laptop makes that worse, as now the child has to have a window open and a healthy chunk of memory occupied at all times in addition to preventing the laptop from going into sleep mode.

Third, the Pi allows for projects which a VM does not. If the child becomes interested in working with hardware, it can be interfaced directly to the Pi. If the child wants to deploy the Pi as networking equipment, whether as an AP, a DNS filter, or a VPN endpoint, they can do that. If they need a second machine capable of acting as a desktop, they can do that. If they want to make it a media center device, they can do that. Its versatility is one of its strongest features, both for students and for those of us who like using it for our own projects.

"And people use it once or twice, find out it is much slower than their PC and it lands in the drawer never to be found again."

That's a lot less noticeable now than with previous generations, but I grant the significant speed difference. When the Pi was new and I saw several people setting up labs with Pis as the computers running a full GUI, it didn't make much sense. However, there are lots of useful things to do with these which will eventually come to mind. Running servers of various types on it is, in my experience, a great educational activity. It teaches the child about the command line, databases and webservers, and anything they choose to use those servers for. It's also a use case where the Pi is well-suited (the server stays up where the laptop's server wouldn't, it doesn't use much power or generate background noise, etc.). And once they've mastered that, they will find new ways to make use of the hardware.

It depends what the product is. I've seen a couple display control systems using the Pi as a controller because they need a full stack and reasonable display speed which the Pi's GPU is good at. I've heard that these aren't unique though I wouldn't know. There are several types of products where the Pi's peripherals and power are already sufficient for the task and the manufacturer doesn't need much additional hardware so they don't see the benefit of a custom board.

Apple extends live-at-work to at least January 2022

Re: Back in your box

"But your comment rules out the possibility that the employer sees value in office presence (or co-located working in a general sense)? How are you ruling this out? How do you know, for a fact, that there is absolutely no value that should be attributed to office or colocated presence?"

A good question, but there is a way. Let us assume a company which allows workers to choose to work remotely or not. If a worker chooses to be remote, but to remain in the same expensive location, how much will the company pay them? Any reduction in value they expect merely because they work remotely should be factored into that value. Therefore, if the company would not reduce that person's pay, but would for others further away, they are not paying for the value they receive.

Re: Shop Stores and iCovid

Yes, but they've decided that they still want to be operating. You can move people out of an office and have them still work, but you can't move the store staff out and still get anything from them. They want to reduce the risk, but they don't want to lose money while doing so.

Using 'AI-based software like Proctorio and ProctorU' to monitor online exams is a really bad idea, says uni panel

Re: In other news.. .

In the article, did we see anybody arguing against it who previously made their living as a professional student-watcher? The students themselves are complaining. Professors, who probably would really like not to have to monitor students because it's extra boring work are complaining about it. Those groups do not stand to lose their jobs, so maybe they have real reasons to complain.

Re: Online exams do not seem like a good idea in general

In many cases, not having to memorize everything in the textbook. If, for example, I'm writing a program and I've forgotten all the possible magic numbers for a system call, I can find out those options from that call's documentation. I shouldn't have to memorize every system call and every option on every different operating system just to do that, because the information is available conveniently. The textbook can serve two purposes. First, it teaches the theory and provides useful techniques which the student will remember and apply later. Second, it provides reference information which the student can look up later. A good student will remember the former because they use it frequently, and can memorize those details which they use most often, using the book to recall those rarer examples.

Re: Its not really AI, is it?

And the preprocessing done to the training data, the preprocessing done to the production data, the specific model or models in use, the output type of those models, the thresholds for consideration of those results, the algorithm to deal with conflicting results from different models, and changes made to all of those since last time it was clearly broken. They don't want to tell people details about any of those.

Re: They never should've used it in the first place.

"What you are proposing would result in a deluge of technicians and engineers who hold little knowledge in their supposed area of expertise, thus diluting the value of a real certification."

In my opinion, if that is true, it means the certification wasn't much good in the first place. The easy methods of cheating are where you look up answers online. That's kind of normal now for most jobs, because if you've forgotten something, it's better to just refer to the docs and therefore not make mistakes. If you're analyzing someone's experience with technical skills, then it makes sense to let them access those reference materials, because if they can successfully obtain the goal in the time limit, then that proves they know enough to find the information they needed and apply it properly. If they know very little, then they will most likely not be able to find the answer or tailor it to the situation in time, so they'll still fail. A test based on rote memorization isn't much use when you need quick analytical or problem solving.

In other classes, there's a better case for such restrictions. A student doing a math test shouldn't be able to just type the questions into a calculator. If you have an environment where the person really can't access the reference materials, then you might want a memorization test as well (but really, that's not many places). Most tests, however, aren't so basic.

Another big year for tape as ... oops. 2020 sales dropped 8% thanks to 'global shutdowns'

Re: Ransomware

A disk which stores 4 TB versus a tape which stores 6 TB. If they're fast at installing new drives, that can take the storage capacity up to 9 TB per tape. They could also start using larger disks. That's not a major difference.

The reason large companies often use tapes instead of disks for cold backups is that it's cheaper once you use enough storage to cover the costs of readers. It's also generally thought better for long-term archives. For cold backups for short-term periods, disk works well too and the hardware exists for it.

Apple didn't engage with the infosec world on CSAM scanning – so get used to a slow drip feed of revelations

Re: It didn't win the prize for creepy idea of the day

Yes, I awarded the full title which you edited and I stand by it. The rest of that comment raises real problems about the practicality of the system. When I said you couldn't do it with video and you couldn't solve the ostensible problem without covering video, that was, in my view, a serious flaw which would prevent a system as described from ever being implemented. There were many more. None were jokes.

By the way, that's only a list of the technical flaws which came to mind immediately. There are other technical flaws including the systems required for maintaining image history metadata with integrity checking. There are also administrative problems getting the world to accept a single standard for this which would work at all and getting all the software developers to only ever process images with that check in place, despite the fact that manipulation of visual data is so easy it's a frequent homework assignment in introductory computer programming classes. A full summary of the fatal flaws I see in it would be quite long.

When I call something useless, it means I think it would either be infeasible to implement or would fail to achieve the goals. In this case, I think both apply. That is without at all covering the ethics of such a suggestion, which is the basis for the "creepy" label which you appear to accept. You may take offense at the flaws I suggest, but I have seen nothing to demonstrate that I am incorrect about their existence.

Re: Apple are hypocrites

The difference is that this technology could be removed, and then it can't be abused. It still exists as a possibility as it always has, but it doesn't exist as an available exploit. If the code is not on people's devices, an abusive government cannot make use of it, and the user is therefore safe from this avenue. That is why it should be removed.

Re: creepy idea of the day

"We could get to the situation in the future where having a JPG on your pc is a hot potato."

No, we couldn't. There are so many images used by programs and websites that there's no way of figuring out which of the thousands of images you care about. No, they're not going to make an expensive, likely cryptographic, format for your desktop icons and video game assets. Oh, and video frames too, because if you don't stamp each of those, people will put their pictures in one and have users run it like a slideshow. That adds complexity and size to anything that reads or writes image data. You might as well ask for mandatory KYC on all text, which isn't going to happen either given how often you use the same text as other people.

"Think how much easier that is to detect by outsiders"

It's really hard to detect. You have several existing formats to detect, which requires a full scan of the user's disk, which the user is likely to dislike. When you've done that, people will immediately invent new formats to get around that. It is a 2D array and disks are big--it's not hard. You're now playing whack-a-mole with format designers. That's without considering pictures embedded into programs which display it when run (if you just set pixels, it will look like text). Then steganography to hide it in something else. Then programs to retrieve the correct bit pattern from another file which isn't signed.

In order to reach step one, you already need something a lot more invasive than has ever been tried. It's not practical. In your title, you left out two words. It didn't win the prize for creepy idea of the day--Apple's got a monopoly on that whenever they open their mouth lately. It won for creepy and useless idea of the day.

Apple's bright idea for CSAM scanning could start 'persecution on a global basis' – 90+ civil rights groups

You are incorrect. They are encrypted after being uploaded with Apple's key. Apple can decrypt them and has done so repeatedly to comply with warrants from law enforcement. Apple has not announced any plans to change this. If they do, which again they have not, it would not justify on-device scanning.

Many would disagree with you. Existing police investigations with limited warranted surveillance have a higher approval rating than this does. Hence, a different method which works and isn't by its nature evil.

That's an option, so for lots of people, yes. Another option is to automatically backup the system to iCloud, so that's another way it could happen automatically. Both probably have to be disabled to prevent it.

"So the situation is. Do nothing about the problem of child sexual abuse because whatever you do will be wrong."

No, the situation is do something else about the problem of child sexual abuse because what you're currently doing is wrong. False dichotomy rejected.