iCloud

A federal lawsuit accused Apple of a design defect for never scanning iCloud for CSAM. In the thread, a commenter who mapped NeuralHash's actual architecture flipped that backstory: the on-device scanner was built specifically to make full iCloud encryption possible, not as an apology after 2021's backlash.

A rival cloud-storage founder in the same thread cut through the debate: client-side or server-side, every scanning method lands on the same "privacy rot," the exact tradeoff Judge Wise says now belongs to Congress, not Apple.

EasyOptOuts says it reported two Hide My Email flaws to Apple in June 2025 that let a third party turn an alias back into your real iCloud address. Apple has twice claimed a fix; researchers say it was still broken as of June 30, 2026.

The firm won't publish the mechanism until it's patched, so the thread reverse-engineers it (a bounced oversized attachment is one guess), while an email engineer says Apple doesn't seem to know or care how its own mail systems behave.

Both Sign in with Apple and Hide My Email aliases are moving to @private.icloud.com. One regex now separates relay addresses from real iCloud mail, and a site can reject all of them in a single rule.

The author's escape hatch: generate spare @icloud.com aliases now, before the change lands, at a rate limit of at least 30 per hour.

The catch surfaced in the thread: ban the new domain and you also break the Apple sign-in button you were told to add.