There is a premium plan for the AI features, so that's the strategy, which does make some sense, I bet a lot of people will want to have those features.
Good software is never freemium. It is either paid upfront or it is a timebomb. I am okay with keeping things proprietary and asking for a fair price. Once free-to-play is introduced, the software is gone for good.
I thought about buying Affinity a couple of months ago since they offered a perpetual license. Now I won't even think installing it
It's a smart approach imo. They had to get a subscription somehow to support AI features which they need to compete (just usage cost wise you can't do that on a one time fee license).
But since they promised not to go subscription when they got acquired by Canva, making it free with AI as the subscription is a clever solution to not break their promise while still introducing a subscription model.
I think their bet is enough people will want the AI, which I think is correct.
As a long time Affinity user, first reaction was: "see, there is the subscription", but on second thought, fair enough, well played. I'll probably get the AI subscription as well.
I do wonder if over time more features will go into that premium plan, but we'll see.
Edit: It seems like some of the AI stuff runs on device, they are not very clear about what does or doesn't. That makes me change my opinion a bit, as that's just straight up a freemium subscription model.
I think there are a lot of people like me who use it occasionally and won't bother with AI nor a subscription. To me this is a bad sign, as free is unsustainable. It's only a matter of time before they look at their metrics and realize "oh look, we have all these casual users who only use the free stuff, that's a new source of revenue!" at which point either the subscription now covers the app, or worse, they steal your shit for "AI training."
Hell, has anyone looked at the EULA for this "free" product? Maybe it's already doing that.
This is not necessarily true when the free product is a sales funnel.
Canva's business model is not "desktop design application" but giving away these tools creates goodwill in the design community and gives them exposure and a lower-friction conversion funnel towards their actual paid products.
Since they're desktop apps, there's very little cost to them for the free users who never convert (unlike Figma or other cloud-based products that have operational/bandwidth costs for all users).
> This is not necessarily true when the free product is a sales funnel.
In my experience, senior sales/revenue/whatever leaders see the free version as competing with the sales motion, not as a funnel (regardless of the reality). And argue to limit it more and more for short term conversion improvements.
I think a lot of the frustration seen here is that while Canva's business model is not "desktop design application" that Serif's (the previous company) business model was. Serif was something of the last one standing selling "desktop design applications" with that aligned to the incentives of "selling desktop design applications". With Serif bought by Canva and moving to a subscription model like all the other remaining tools, there is no one left with "selling desktop design applications" as a business model. That seems long-term unsustainable if your interest is "desktop design applications" that do their jobs well with few upsells to long-term subscriptions. The unsustainability that leads to upsells and subscription paywalls only generally ever get worse over time, because users of the free part aren't the desired customer.
On the plus side, when they layoff every single person that worked on Affinity in order to better align with something something market strategy, those people will be able to get together and start a new non-subscription desktop design applications company... with blackjack... and hookers.
I think you can still get Paint Shop Pro and CorelDraw as a one-time purchase from Corel. I'm not sure how good the current versions are, but I regularly use Paint Shop Pro 8 from 2003 and enjoy using it. Of course, it's definitely a rug pull if your workflow is Affinity focused and you have a ton of Affinity format files around.
Today's Corel seems very much a "use at your own security/bug risk" license-selling factory. They still sell support contracts (because those are lucrative) and sometimes patch the software for big security issues, but they seem to do that on a staff that is far more salespeople and lawyers (to wrangle ancient B2B legal contracts and new "minimal effort" security support contracts) than software developers. Their business model doesn't seem to be as much "selling desktop software" as it seems to be "fulfilling old support contracts for the zombies of classic desktop software".
That said, yes, maybe PSP and CorelDraw will solve some uses of parts of Affinity's stack for people looking for an alternative and don't mind paying close to full price for code that is mostly frozen in time from the late 90s and early 00s.
No. Because it's part of the cost for Black Magic Design that if they want to have their own hardware and not have the industry's monopolists (Adobe and Apple) make it difficult to maximise their sales, they need to control their own app.
This is what Canva think about their asset marketplace and AI tools, I guess. They need their own app to make sure Adobe can never so much as tug at the corner of the rug.
Canva makes $3+ billion (up from $1.5 in 2023) per year; they have 21 million paying customers out of 240 million users. "Only" 8.75% are paying customers.
They don't need huge uptake in AI subscriptions from Affinity.
So yeah, free is sustainable for the foreseeable future.
My experience: clients want to use Canva for everything; designers don't.
This has a reasonable shot at eliminating reasons for designers to pass complex work back to Adobe's suite. If they disrupt Adobe's dominance at the professional end of the market, it puts Canva in a very comfortable position.
As long as Adobe is charging huge amounts of money, it seems like a free desktop app that competes with that and integrates with the existing Canva ecosystem would be worth it.
It looks like it is an offline application (after license verification) in he FAQ
>You will need to be online to download and activate your license with your free Canva account. From then on, there is no requirement to be online, even with extended offline periods.
As a long time Adobe "user" (read: hater) I'm curious if this decision targets Adobe or Microsoft options more..? Maybe both.
>You will need to be online to download and activate your license with your free Canva account. From then on, there is no requirement to be online, even with extended offline periods.
Until you get a 2am e-mail stating that they've updated their terms of service, and by reading the e-mail, you have agreed to the updated terms because the chances of you challenging this in court are precisely zero, no matter what the internet IANALs say.
Free is not unsustainable if there is a paid tier.
For people like you who only use it occasionally, you're not the kind of person who's going to pay in the first place.
It's sustainable if the professionals people who use it daily/weekly find it's worth it to pay for the AI tools. And if you're a professional, you'll likely be needing those AI tools to keep up.
Thank you (long-time Affinity user and fan, and Canva employee here :)
Re. on-device AI features: these still have significant training costs; and Canva as a whole has paid hundreds of millions to date in royalties to creatives, including for AI training.
Affinity is free, forever; but not open source; if that makes sense.
I don't think it disappears - the copy I have will still be on my machine, and free to use as well. Unless they implemented something to remotely delete it?
This is only true for very badly written software, and/or on platforms that maintain very bad backward compatibility. It's not some natural law of software--it's choices that (IMO) bad developers choose to make over and over.
It’s not just the case of badly written software. It will work until they shut off the license servers.
Adobe CS2 is a highly-capable software suite that would happily run on today’s computers. I remember when Adobe shut down the license servers for CS2. They released a version that you didn’t need to activate to assure people that they would still be able to use the software they bought in the future. But then they got tired of hosting the download servers, so they stopped, and that was it.
This already happened with Affinity Photo v1 on iOS; a lot of functionality did not work after an iOS update. It feels like Apple changed something in their libraries, so it doesn't even matter how robust your software is if the underlying OS doesn't honor compatibility.
The Apple ecosystem, in general, is notorious for this: If you update your OS, some 3rd party applications will suddenly no longer work, because Apple keeps introducing breaking changes. But, if you don't update your software, other 3rd party applications will quickly abandon you and block you from using their software until you update. So, you're damned if you do, and damned if you don't. Complicating this is: if your hardware is "too old" (as deemed by Apple), you can't update your software, so eventually you're left in the dust. You can't win.
Unfortunately there's also security people who work day and night to break old software and hardware that cannot keep up with the latest security standards.
your gripe is valid but misdirected. I also own a copy but, the one-time validation requires a validation server. Once that server goes offline, i can no longer install Affinity on a new machine.
I am sorry, but for me the app just died. That may sound dramatic but the promise at acquisition was that nothing would change. The picture that was drawn is that we would get a v3. Sure I would suspect some canva integration, but again, not a whole redo and relaunch that seems at first glance nothing like what we had, and completely taken over into the Canva system.
I have a free subscription to Adobe Creative Cloud (I was a long-time, early employee and negotiated this as a perk). One reason I paid for and use Affinity is that it DOESN'T have AI. I want to be completely sure the photos I edit don't go up to a "cloud" somewhere, etc.
It's smart only if their business goal is to lose every single customer they had specifically because it wasn't subscription software and didn't have the AI junk that their customers specifically did not want.
The DTP app actually does something that neither InDesign nor Quark handles properly, but it's something so specific I would dox myself if I mentioned it.
It looks very similar to what they already had. If you had all three they all were already integrated, you can just switch between the different types of editing modes.
But then you don't need uv. The pain point uv solves is projects. Different projects with different dependencies (even the same but different versions), multiple people, teams, and environments trying to run the same code.
That gets problematic if environments go out of sync, or you need different versions of python or dependencies.
So you are right, you probably won't benefit a lot if you just have one big environment and that works for you, but once you pull things in a project, uv is the best tool out there atm.
You could also just create a starter project that has all the things you want, and then later on pull it out, that would be the same thing.
> Detection will not apply to accounts used by the State for national security purposes,
maintaining law and order or military purposes;
If it's all very safe and accurate, why is this exception necessary? Doesn't this say either that it's not secure, or that there is a likely hood that there will be false positives that will be reviewed?
If they have it all figured out, this exception should not be necessary. The reality is that it isn't secure as they are creating backdoors in the encryption, and they will flag many communications incorrectly. That means a lot of legal private communications will leak, and/or will be reviewed by the EU that they have absolutely no business looking into.
It's ridiculous that they keep trying this absolutely ridiculous plan over and over again.
I also wonder about the business implications. I don't think we can pass compliance if we communicate over channels that are not encrypted. We might not be able to do business internationally anymore as our communications will be scanned and reviewed by the EU.
> It's ridiculous that they keep trying this absolutely ridiculous plan over and over again.
There is a certain group of politicians who are pushing for this very hard. In this case, the main thrust seems to be coming from Denmark, but from what I understand there are groups (eg. europol) pushing this from behind the scenes. They need the politicians to get it done.
I think that one problem is that politicians defer too much to "experts" in decisions like this.
I cannot remember who it was, but one British prime minister, when told by intelligence services that they needed greater surveillance powers, told them essentially, that of course they would claim that, and firmly refused.
Politicians now mostly lack the backbone. That does not stop them ignoring expert advice when it is politically inconvenient, of course.
The problem is not they ask experts. Politicians are so utterly incompetent on the thing they are putting law on, at the level they will believe openoffice is a firewall[1]. That doesn’t mean all of them are that blatantly unaware of the basics for which they are supposed to decide of some rule, but that is definitely a thing.
The next thing is, do they know how to rely efficiently on a diverse panel of expert, or do they take only yes-man/lobby-funded experts around them?
On a deeper level, are they accountable of the consequences of their actions when they enforce laws which any mildly skilled person in the field could tell will have disastrous side effects and not any meaningful effect on the (supposedly) intended goal?
What we need is direct democracy, where every apt citizen have a duty to actively engage in the rules applied without caste exception.
Let’s protect children, yes. What about making sure not any stay without a shelve to pass the winter[2]? Destroying the right of private conversation except for the caste which decide to impose that for everyone else is the very exact move to offering children a brighter future.
> The next thing is, do they know how to rely efficiently on a diverse panel of expert, or do they take only yes-man/lobby-funded experts around them?
Unfortunately, I know the answer to that!
> The problem is not they ask experts
I think with with IT they do realise that they do not know. They also believe someone who says something is feasible, or a good solution over someone who says it is not.
>Regarding your parent, "direct democracy" is a euphemism for mob rule.
Anything that pretend to be democracy without imposing active participation of citizen in ruling is an euphemism for some other system which doesn’t dare to present itself for what it is.
Oligarchy is not democracy. Aristocracy is not democracy.
Assimilating the only actual form of democracy to its degenerated ochlocratic form, and pretending that whatever undemocratic political regime that officially brand itself as democratic is so: thus are the two basic strategy of newspeak control. War is peace.
Yes there is a risk with actual democracy. The full truth however is that there are risks of degeneration with any political system. Pseudo-representative systems used in western side have by far cross the threshold of mere theoretical possibility to degenerate into oligarchic plutocracies.
Moreover which caste brandishes the scarecrow of the hypothetical fickle crowd to evict actual democracy? And in support of which system, and what caste will it favor?
The nailing point of democracy is not that it’s perfect and immune of any big issue. The cardinal point of democracy is that people are promised the pains and joys they will self-provide for themselves; so the control feedback loop of changing their own behaviors and rules stay in their power.
Maybe we should scan their communications for corruption and undue influence. I'm sure it's all above board, so it should be fine if we get an independent group to review them right? (Just following to their reasoning..)
Our current minister of justice in Denmark, Peter Hummelgaard, says "yes" to everything proposed by the police and intelligence agencies. Meanwhile, he has demonstrated no ability whatsoever of understanding the technical challenges of implementing something like this, and he firmly insists on the false claim that it is possible to let the police read encrypted communication without compromising the security model. He also directly spreads misinformation and downplays the significance of this by falsely claiming that Meta and others already scan E2EE chats to show us advertisements. He has said that he wants a crime-free society, and I don't doubt that that is his goal. I just also think he is too stupid to understand that a crime-free society has never existed, and if it is attainable, then it is probably not a very free society.
All in all, he seems to be a scared, stupid sock-puppet of Europol.
And I doubt you achieve it by taking away people's privacy. There are bigger issues that need to be addressed and have nothing to do with E2EE. If they cannot address that, then ...? They just do not seem to care about what they are claiming to care about.
That one line on its own should be enough put the illegitimacy of this proposal on clear display. Privacy for me (the surveillance state) but not for thee (the populace).
If you read it closely they are not mandating backdoors in encryption.
WhatsApp could still have messages end-to-end encrypted. What they would be mandated to do is for the app to send copies of the messages to WhatsApp for their staff to review the contents.
This obviously breaks the point of end-to-end encryption. Without actually making it illegal for them to use encryption, or add any “backdoor” so it can be reversed.
It’s a weasely way of trying to have their cake and eat it.
But it is available for use. Corruption is not a fantasy but a reality. Usually who reach the top on political scale have seen it all, I mean all. Being polite to describe this reality use cases, (inside trading, political targeting, discrimination, monopoly etc). Who would know, who can stop it, who would dare!
What are the protection mechanisms?
Are we suppose to hope that the untouchable/s is 100% honest?
> If it's all very safe and accurate, why is this exception necessary? Doesn't this say either that it's not secure, or that there is a likely hood that there will be false positives that will be reviewed?
Its all a scam! No one cares about you.
They are just setting up the new infrastructure to manipulate & control the docile donkeys more effectively (working class)
It is pointless exception. If chat control will pass, everything is vulnerable by design. Or how do you distinguish if WhatsApp is installed on a phone of Joe Nobody or or a phone of a politician? You won't, unless you have some list, which can be leaked and from "do not touch credentials" will turn "target these credentials"
The exception means legally, that category of people, can't be prosecuted even if incriminating stuff were collected through such channels.
The next logical step, after a prosecutor or political push, would be for the Highest Order Courts of Member countries to invalidate evidence collected through such channels for those categories of people.
You are looking on it from a wrong perspective. You have access to communications of politicians, military and government apparatus. You can effectively control these figures through extortion (I know about your mistress) or blackmail (I picked up your kids from school today next time I may keep them for a while)
Politicians who are pushing these laws are having a feeling that bad things can't happen to them. However they are usually prime targets for bad things happening to them, because they are the ones wielding the power - if you can influence the politician, you can control his power.
“False positives” is the most likely explanation. A common tactic for government agents is to pose as criminals and extremists, either to more effectively infiltrate existing criminal or extremist networks or to run sting/entrapment operations.
As someone who lived in a country under the russian boot at some point and who remembers the USSR from direct experience, you probably have a lot of stuff to study up on. But be careful on what internet connection you do it.
Direct experience of the USSR, in the Netherlands? I must be in the wrong timeline because mine certainly didn't have the Dutch Soviet Socialist Republic!
Anyway, it's cute that you chose to respond with a personal attack on me. Looks like you don't have any other argument, and you know it :)
Oh Harry, don't worry! Everyone can happen to have bloated his aunt by an accident!
(quoting from memory), and also
I like Ludo. He was the one who got us such good tickets for the Cup. I did him a bit of a favour: His brother, Otto, got into a spot of trouble — a lawnmower with unnatural powers — I smoothed the whole thing over."
I lost count how many times the "lets get rid of encryption" plans have been tried and failed. It's truly ridiculous how these people don't understand anything about encryption and somehow still think this is a good idea.
How is it possible that after years of discussing plans like this, they still managed to not listen to anyone who knows anything about encryption and online safety?
Makes me really worried about the future. There is a lot going on in the world, and somehow they feel the need to focus on making our communications unsafe and basically getting rid of online privacy.
The goal they are trying to achieve is good, but the execution is just stupid and will make everyone, including and maybe especially the people they want to protect, less safe online.
The age verification thing is another example. All it does is send a lot of sensitive traffic over cheap or free VPN's (that might be controlled by foreign states). Great job, great win for safety!
I do not agree with you that they have good intention or have good goals. They know what they are doing, and they are doing it to gain control. I think by saying they have good goals, but they don't know better, we are down playing the danger. They know what they are doing, and they are doing it to have more power over people.
I agree with you (i.e., I share your belief that the whole "safety" argument is a bold-faced excuse to just gain more control and surveillance power over the population), but I believe that the parent comment was just trying to be extra charitable to those pushing for the bill.
I think it is fair to give the opponent's position (which both you and I believe is in the wrong) a steel-man argument treatment, by assuming the best possible interpretation of their argument (even if they don't imo deserve it, and you don't believe in their stated intent).
The approach makes sense to me, as attacking and debating genuineness of someone's intentions is an endless rabbithole. So if you have an option to decimate their case, all while assuming their stated intent to be truthful and genuine, that's a pretty solid way to actually move the needle on the argument in a desired direction.
They have evil intentions, but they are also idiots. The nature of an authoritarian government is one that requires maximizing control for survival. As a particular country shifts to a more authoritarian government, and those people who enabled dumb ideas fall out of power (right, left, or whatever) those same tools will be used by their political adversaries to control, imprison, or kill them.
Why are they idiots? Because western Europe is not yet authoritarian and thus there is little personal benefit to hasten a slide towards it, there are so many other ways to gain power in a free society. (I wouldn't bet money that Europe will remain free in 25 years.)
There is a secondary problem here -- anything that decreases the information security of European countries hands more power to the US and China (and to a lesser degree other nations with advanced infosec capabilities like Russia and Israel.) If you are European (I'm not) the first thing that should be done is investigate the people pushing this stuff.
People need to understand that some people are abusers by nature and mentality, some from birth, some by upbringing. And they crave power.
The sayings like "those who want power rarely deserve it" exist for a reason, except until the last few decades we didn't have a good enough understanding of psychology to explain why. Now we do. Some people have anti-social traits and they should never be allowed in positions of power because they are mentally ill.
Difference is "normal" mental illness like psychosis is harmful to the individual who has it. Anti-social mental illness is harmful to those around them, especially those under them in hierarchical power structures.
It’s right there in the name: Chat Control. Take them at their word!
Look at Australia’s “hacking” bill. It was about letting the government hack (take over) your account and post as you. The “hacking” referred to ahat THEY would do — to YOUR accounts:
There needs to be accountablility regardless of intent for policies that affect everyone.
I agree with you though, they know what they are doing and about some implications at least.
I hope most services will just block Denmark though. Any investment in such technologies is a waste and should come to a great cost to developers. In this case Google products in general should be shunned. Not that they were famous for steady support of products instead of quickly killing them.
The seeming trend that worries me the most these days is the lack of competence at multiple levels of society. Our leaders, their supposed subject matter experts, the people doing "the science" all seem to be demonstrably incompetent at their jobs. I don't know if this is an actual trend or just the perception of one but it's concerning either way.
Why do you call them "leaders"? They are "people in positions of power".
I don't understand where this desire to be led comes from. Other people do not have your best interest in mind. I want others to get out of my way, unless we have a conflict of interest and then we _might_ need a third party to resolve it. But I certainly don't need or want to be led.
Because I fundamentally disagree with the whole "power" is everything dynamic that seems to crop up here. They are leaders because people follow them. The only power they have is the power that others give them. Leaders captures that better than "people in positions of power".
Almost all power is like that. Power comes from the ability to do violence (or threaten/imply it) and there's only so much guns and ammo you can carry. Not to mention the attacker has the advantage here and full-body ballistic protection would be too cumbersome and still wouldn't stop an IED. I mean, the IRA mortared Downing Street and that was 1990s tech.
To amass enough violence to control large numbers of people, you need to incentivize other people to apply violence for you. Dictatorships are more honest in this regard - they reward such subservients with the opportunity to abuse others for pleasure and material benefit.
Democracies OTOH tell people that we're all better off if the system works and anyone upsetting it hurts everyone so it's everyone's best interest to "pacify" them.
You're right that many people are very submissive though and just do what they are told even it it harms them long term. Usually the forcing mechanism is other people would punish you if you didn't punish the person you are supposed to. I mean, most of the cops who hunted down Luigi benefited from the CEOs death, yet they still did it. Because the benefit is too indirect and delayed and the punishment for getting caught not doing your job on purpose is immediate and direct.
I still object to the term leader because they don't lead, they tell people what to do. Not all leadership has to be be example but it implies some participation in the activity, its benefits and its dangers. Modern politicians are too well-shielded from the reality of working people.
No cop who hunted down Luigi benefited from the CEO's death. Not a single one. Unless by benefit you mean "felt good about the death". Which, is lame and sad for anyone who thinks that. No policy changes were made as a result of the death. No systemic changes are going to happen as a result of the death. Pretending like there was something to gain from it is at best naive and at worst actively harmful to society.
1) Some CEOs stopped posting their photos and other information online, clearly understanding they too could become targets and somewhat lowering the social prestige of that position.
2) One insurance company backed down from its attempt to decide how long anaesthesia should last instead of the doctors.
A long term effect is that many podle feel empowered to talk about how big companies and abusing the system and what they think should happen to people controlling those companies.
Look how many doctors and nurses started taking about the abusive practices of insurance companies. Hopefully it leads to change, otherwise it's likely events like this will keep happening, especially when the abused are people who have little to lose.
The first as an effect is negligible and likely extremely temporary. The second I'm unfamiliar about and also likely extremely temporary. Your long term effect I disagree with. I don't think the murder made people feel any more empowered than they were before. But if you want to make that as an example then I think I have roughly about as much evidence that it empowers people to think murdering cops for the same power dynamics at play.
"the science" I don't agree with this part, and I think it's quite dangerous to rope that in.
Science is not one way of thinking, it's a methodology, it's seeking truth. There might be bad actors and idiots, there is likely lots wrong, but the beautiful thing about science is that facts matter. If someone publishes bullshit you can repeat the study and proof them wrong.
That science is (wrongfully) taken as justification for stupid things, is not on "the science" as a whole.
If anything makes me hopeful, it is science and the remarkable developments happening.
Here's the problem though. Scientific studies that are one off, not replicated, and standing on dubious ground are getting used to justify numerous societal and policy changes. So while "Science" the practice of studying and understanding the world is laudable, the masqerading of the intermediate artifacts of research to support dubious conclusions is not. Which is why I put quotes around "the science" because the problem is that what people keep claiming is science is in fact not.
Key enablers that ensured those plans fall apart were PC platform and default code freedom on it. It doesn't work because anyone can just compile the clean versions of apps using gcc, on PC. Same cannot be guaranteed on Android and is not even happening on iOS.
We shouldn't have shrugged off the weird feeling of shackles on our wrist when iOS(iPhoneOS) was first released. We should not have relied on geohot stopping by and dropping a jailbreak he found. We should have voted to force it open by law.
cannot emphasize this enough. Workarounds were always tolerated because they silenced the potential competition until the frivolous features that people did it for (namely customization) were all available by default, closing the door for what Apple actually hated (side-loading). They are expert software politicians, just look what they do with the EU's open-ecosystem demands
The proximate goal they're trying to achieve is mostly irrelevant when compared to the broader technical goal. That goal is to force all messaging systems to re-architect so they include a "bump on the wire" that hosts a scanning mechanism sophisticated enough to recognize novel (unknown) image content. This implicitly requires re-architecting these systems to contain neural-network image classifiers that operate over a model that's kept secret (to the user/client.) Everything else is sort of irrelevant compared to the implications of this new architecture.
The "good news" for now is that the systems deployed in this model won't classify text, only images and URLs. The bad news is that the current draft explicitly allows that question to be reviewed in the future. And of course, once you've re-architected every E2EE system to make image scanning possible, most of the damage to cybersecurity is likely already done; a year or two down the road, text scanning will probably be viewed as a modest and common-sense upgrade. I expect that folks who object to text scanning on cybersecurity grounds will be informed that the risks are already "baked in" to the image-scanning model, and so there's no real harm in adding text scanning.
Leaving aside the privacy issues, this is basically an existential national security risk for Europe. It's amazing to me that they're walking right into it.
It's important to remember that government is not your friend, isn't meant to be, and never has been. It's a machine of control that needs to be held in constant restrain by the population. Obtaining more control is the expected behavior of those who come into power, shown through all of history.
What is progressive about rampant decontextualized chat? I read these anti-control statements by what appear to be tech zombies who know nothing about the tech being promoted. LLMs/ML are based on faulty, Western units that are about defining reality in individualistic, material terms, lacking interdependence and relying on arbitrariness to destroy that chance for shared experiences.
If governments are leery of LLMs for the wrong or right reason and the industry and technology lacks any kind of grasp of what it is and what the inputs are, then BOTH are wrong and the tech needs dismantling.
If the decontextualizing of communication is epidemic, as it appears to be in Chat, then the industry has failed not grasping the first thing about the technology.
I think you're confusing technical encryption with the privacy of encryption.
For example, let's say I implemented a CSAM-scanning AI model in my chat app, which runs locally against your message, before communicating the message over an encrypted HTTPS channel. If the message is flagged, it can be sent over an encrypted HTTPS channel to authorities, on a secondary separate connection. At no point, did it leave the device, in unencrypted form.
Is that message encrypted? Yes.
The way that you want? No.
Governments have recognized this distinction, and have figured out they can have their cake and eat it too; the security of encryption with none of the privacy.
>If the message is flagged, it can be sent over an encrypted HTTPS channel to authorities
okay, but how do you prevent me from intercepting that communication.
Or even running my own copy of the local model and determing ahead of time whether it will trip the alarm. If the attacker has access to the model, they can effectively make a GAN to modify images to get past the filter.
> In cryptography, encryption (more specifically, encoding) is the process of transforming information in a way that, ideally, only authorized parties can decode.
From Wikipedia. They can’t have their cake. You are breaking the concept of information into smaller steps (e.g. message) when that is against the definition.
Governments don't define encryption that way - they define encryption as the process of transforming information in a way that, ideally, an adversary cannot decode. Messages are unreadable if Russia hacked Vodafone, or China hacked Verizon, that kind of thing.
There's a significant difference there between a government's definition and Wikipedia's idealism. Or, even if they subscribed to the Wikipedia definition, they would say they have the legal right to be an authorized party.
Creating new words and definitions doesn't justify any initiatives. The point is that they try to mislead the common people. So we can't really say that "someone is confusing the terms", when the entity in question just created the new definition?
It works, because you already tried to argue with that. And it is not the Wikipedia. The whole existence of encryption is evolved around the concept of information. And even the government's definition can be argued, because the adversary is defined by the sender and the receiver, not by anyone else.
When there is law, then the definition matters and there is legal stand, but before that, it is just an initiative which tries to mislead.
Another example of such degenerate-encryption would be having messages "end-to-end" encrypted, but a copy of the key is kept by a service-provider or even sent in advance to a government agency.
People usually mean "end to end encryption" in these situations, and by adding a third "end" to the system, you bypass the whole point of end to end encryption.
My above example is end to end encryption compatible, it's just that you don't get to pick the end it might go to. However, the connections between ends are still encrypted. As such, it passes the technical mathematical definition (one end having a direct pipe to the second end, with nothing possibly in between), but not the philosophical one.
Governments have never cared about the encryption philosophy; only the math aspects and international risk - which, in this example, are technically satisfied.
all of this is basically irrelevant, given that the type of ppl who this legislation claims to target can always just resort to email + pgp or some such, over which governments don't really have any meaningful control...
My guess has been an unholy alliance between 'IP holders' like Hollywood (and increasingly games), and the surveillance industrial complex.
Add in the fact that both China and the US already have practically near omniscient digital oversight of everything their citizens do through server and OS level backdoors, the uninformed politicians in the EU/UK are easier to tempt by lobby groups crying in the name of the children.
No, this is not corporate lobbying responsible. Stop giving your beloved politicians an out and acknowledge they do not have your best interests at heart, only a thirst for power.
The buck stops with the politicians signing this into law.
No better way to quench your thirst for power than to choose to go into Danish politics and move up to EU politics to herd 500 cats to be in favor of some legislative surveillance scheme that, if implemented, you'll immediately lose all control over to different technocrats.
I'm sure you'll find somebody who fits that bill, but since it's a democracy, we're more interested in why the other 45% went along with it because they can be reasoned with.
> The goal they are trying to achieve is good, but the execution is just stupid and will make everyone, including and maybe especially the people they want to protect, less safe online.
If so, the best way to stop that is to sugest a good way to achieve the good goal.
It is perfectly possible to encrypt a message such that two different keys can decrypt it. There is nothing in modern encryption that makes that impossible. See https://faculty.cc.gatech.edu/~aboldyre/papers/bbks.pdf and many others.
So your chat app encrypts your message with the recipient's public key and the state's public key.
Hey presto, you have a message which cannot be read by someone who casually intercepts it. If the state seizes your message - or records it for later analysis - they do not need to break encryption. There's no plain-text version laying around for anyone to sniff.
Is this a good idea? No. Even ignoring the civil liberties aspect, we know that key management is extremely difficult. A leak of the state's private key(s) could be devastating.
But let's not pretend that this is somehow technologically impossible.
>>> A leak of the state's private key(s) could be devastating.
Preventing this leak is what's technologically impossible. A leak includes when the government that's keeping the keys decides to start abusing their access to the data.
It's really hard to say whether something like that is impossible.
I'm not aware of, for example, Google's private signing keys for Android being leaked. Sure, plenty of CAs have been breached - but not all. That suggests it is possible to key these keys secure.
That's fair. But it turns "possible" into a statement about a company's or government's expected degree of restraint, rather than a mathematical statement about the robustness of an encryption scheme.
The famous case is what happened to government birth records when the Netherlands were overrun by Germany in WWII. They weren't even encrypted, but mere transfer of access led to tragedy.
Why would someone want to breach Google's private signing keys? It's easy enough to get malware signed just by submitting it through their ordinary processes.
A better analogy would be the keys used by Microsoft to secure Outlook inboxes.
> Preventing this leak is what's technologically impossible.
Is it? Put the key in a TPM module in a well guarded server in a well guarded datacenter. Have the prosecution send the encrypted blob to the server and then receive the messages in clear from the server.
That way, there is absolutely no way the private keys can be leaked.
When people say it is impossible, they clearly mean it is impossible to do in a way that isn’t entirely broken by losing one key. You know this and please don’t pretend that you don’t. When competent cryptographers say the word impossible it has a very clear definition.
The govt key decrypts everything, real-time and stored/archived, sent in that nation during the time it is in use, and that key is in use in multiple places/machines, and is in an org that is a high-profile target for many other reasons (so could likely be exposed in a crack that initially had other purposes.
In contrast, a person's key can decrypt only that person's messages, is used only in one place (usermset of machines), and is a generally low-value target.
Insanely huge difference between losing a person's key vs the key to an entire nation's communications, even if it is the key of the nation's president -- still far lower value & consequences (start with: if you have the nation's key you can decrypt the president's comms anyway).
One person losing control of their keys only really affects them and people they talk directly to. The government having some super key(s) that access everyones messages affects everyone.
> It is perfectly possible to encrypt a message such that two different keys can decrypt it. There is nothing in modern encryption that makes that impossible.
Not really, any more than it's possible to write a message that says the same thing whether you read it in English or Swahili. You might be able to do it once as a novelty, but the approach won't generalize.
There are multiple-recipient schemes, but they don't rely on using two different keys to decrypt the same message. Instead, you encrypt the message (once) using a (single) symmetric key, and you prepend a bunch of different messages saying "the symmetric key is xxxxxxxxxxx", one for each intended recipient. Those are encrypted with keys specific to each recipient, and each recipient has to attempt to decrypt them all and select the one that decrypted successfully.
The paper you link appears to be discussing an entirely different problem: its definition of a "multi-recipient encryption scheme" does not contemplate sending the same message to several different recipients:
> There are n receivers, numbered 1, ..., n. Each receiver i has generated for itself a secret decryption key sk_i and corresponding public encryption key pk_i. The sender now applies a multi-recipient encryption algorithm to pk_1, ..., pk_n and messages M_1, ..., M_n to obtain ciphertexts C_1, ..., C_n.
> Each receiver i can apply to sk_i and C_i a decryption algorithm that recovers M_i.
> We refer to the primitive enabling this type of encryption as a multi-recipient encryption scheme (MRES).
Note that there is no requirement for anyone other than recipient i to be able to understand message M_i. As described, all encryption schemes are multi-recipient encryption schemes, because you can just consider each message M_k individually and encrypt it to recipient k using a single-recipient scheme.
Chat control opens an additional data channel where messages are sent through, if the detection algorithm finds something suspicious. It effectively makes encryption useless, because someone else, who shouldn't be part of your conversation, is also able to read your messages.
Partially it is new corrupted people getting bought in positions of power. There is interest behind this stuff that we have not eradicated. As long as that is allowed to continue, we have to take down one puppet after another. A new puppet is already waiting for their chance to make buck campaigning for the same shit again. After some years in office they don't care what happens to society afterwards. They only care they got their fat paychecks and post politician positions in management layers of big corp.
And we elect their parties and these people over and over again, instead of making them utterly fail the next election. Too many of us do not see through these thinly veiled attempts and too many of us are too comfortable to vote them out.
> they still managed to not listen to anyone who knows anything about encryption and online safety
Why do you assume something like that? Do you actually know the arguments that the parties in favor of this kind of regulation are presenting? And can you dismiss them based on objective facts?
> The goal they are trying to achieve is good
That is what should be, in my opinion, the basis of this discussion. Assume good intentions and try to work out with the parties involved to achieve the goal in a reasonable way. This is the way, I believe.
Hand-wavingly dismissing other party's arguments would be in my opinion disingenuous.
>>Why do you assume something like that? Do you actually know the arguments that the parties in favor of this kind of regulation are presenting? And can you dismiss them based on objective facts?
The moment anyone brings up the whole "just put a backdoor in that only we can access" despite years of people who actually know better saying that's not possible, is the moment when any further arguments become moot and not worth any further engagement or assumptions of good intention.
That's the single argument all these stupid "chat control" like proposals are based on.
Who is arguing for a backdoor? Do you actually know what are the proposed technical approaches or are you making assumptions?
> people who actually know better saying that's not possible
What is not possible?
> all these stupid "chat control" like proposals
For example here, you make your argument by stating that these proposal are "stupid". There is no effort that I can see to even try to understand where the other party is coming from.
And that is an issue, in my opinion. I think that a productive and honest conversation about a complex issue like this one requires empathy with the other party's position.
>>Who is arguing for a backdoor? Do you actually know what are the proposed technical approaches or are you making assumptions?
The 14 EU countries pushing for this policy to become law. Do you actually know the proposed technical approaches or are you just making assumptions?
>>What is not possible?
See my previous comments. I made it quite clear.
>>For example here, you make your argument by stating that these proposal are "stupid". There is no effort that I can see to even try to understand where the other party is coming from. And that is an issue, in my opinion. I think that a productive and honest conversation about a complex issue like this one requires empathy with the other party's position.
In situations such as this your empathy is misplaced. It should not be with the
bureaucrat seeking access to your private conversations under the false pretense of "keeping you safe" from w/e today's boogeyman is. It should be with the people who's safety is bolstered by the ability to have private conversations.
If you don't understand why this sort of stupid chat control policy is bad then there is no productive or honest conversation to be had.
I'm not assuming anything, I work in software development. In this industry we spend ungodly amounts of time and resources to attempt to keep data safe, and create systems like the ones proposed to flag and handle malicious activity of many kinds. I think I know quite well how hard it is, and how easy it is to get it wrong, with potentially very real consequences.
The only things being handwavingly dismissed are the collateral damage, side effects, very real risks, and concerns about the effectiveness of the proposed solutions.
I have tried both, and find myself not using either.
For both the quality is less than the top performing models in my experience. Part of it is the models, part might be the application layer (chatgpt/claude). It would still work for a lot of use cases, but it certainly limits the possibilities.
The other issue is speed. You can run a lot of things even on fairly basic hardware, but the token speed is not great. Obviously you can get better hardware to mitigate that but then the cost goes up significantly.
For self hosting, you need a certain amount of throughput to make it worth it to have GPU's running. If you have spiky usage you are either paying a bunch for idle GPU's or you have horrible cold start times.
Privacy wise: The business/enterprise TOS's of all big model providers give enough privacy guarantees for all or at least most use cases. You can also get your own OpenAI infra on Azure for example, I assume with enough scale you can get even more customized contracts and data controls.
Conclusion: Quality, speed, price, and you are able to use the hosted versions even in privacy sensitive settings.
Any decent sized project will encounter breaking changes in dependencies.
The big frontend frameworks have great backward compatibility and usually provide codemods that automatically update your project.
If you install UI components and other libraries that might get abandoned or have breaking changes in major version updates you might have to put in more effort, that's not different in Go or Python.
