skysight-inc/HackerNews huggingface dataset:
After more reading of the whitepaper I think you are right. As I understand it, given the image hash H0 and CSAM hashes H[1]...H[n] (some might be duplicates in disguise) the algorithm proceeds like this:

- The device generates a secret X and divides it into X[1]...X[m] with the secret sharing algorithm. m is some large number and any k (but no less) copies out of X[i] are enough to reconstruct X.

- The device stores blinded hashes f(H[1])...f(H[n]). The function f itself is not known to the client.

- The image hash H0 is compressed with another function g to the range between 1 and n.

- The downscaled image data (for the human check) is encrypted with X and appended with (probably) random X[i].

- The result is then encrypted again with a key derived from f(H0) and sent to the server with an associated data g(H0).

- The server tries to decrypt it with a key derived from f(H[g(H0)]). This is only possible when H[g(H0)] = H0, i.e. H0 represents some known CSAM.

- You can only decrypt the second layer with at least k copies of X[i] then.

At this stage Apple can still learn the number of CSAM images less than k. The fix is described in an overly technical document and I can't exactly follow, but supposedly the client can inject an appropriate amount of synthetic data where only the first layer can be always decrypted and the second layer is bogus (including the presumed X[i]).

---

Assuming this scheme is correctly implemented, the only attack I can imagine is the timing attack. As I understand a malicious client can choose not to send false data. This will affect the number of items that pass the first layer of encryption, so the client can possibly learn the number of actual matches by adjusting the number of synthetic data since the server can only proceed to the next step with at least k such items.

This attack seems technically possible, but is probably infeasible to perform (remember that we already need 2^95 oracle operations, which is only vaguely possible even in the local device). Maybe the technical report actually has a solution for this, but for now I can only guess.
One of my favorite examples is Elliott Smiths From a Basement on the Hill. It undoubtfully has Rob Schnapf's signature on it, but you can tell he tried to keep the incompleteness in the work - you get a sense that Elliott Smith was in the middle of creating a new sound, and it feels like he was half way there. At any rate - that record was very controversial, despite being guided by those who were close to him and worked with him.
> The necessary implication would be that waste from patients on certain drugs should be treated as hazardous, or even radioactive.

I thought that was common for patients on chemotherapy drugs? I remember seeing some sign in a hospital room's bathroom about it, but the details escape me.
> Linux is incredible... and still unusable for many everyday apps and workflows, and simply not an option for many people including myself. I've tried Linux distributions since 2011, they aren't there yet.

I have actually totally dumped Windows recently (I have tried it past 5 years), because now Linux is getting very close for everything I need, and this same applies for many people. Can you give some examples which aren't there yet?
It was more because of the, what I thought, was "counting on one hand". Seems like my brain tricked me.
Brain zaps. Feeling like I was going to puke all day every day for a month. I somehow avoided one of the more common side-effects and withdrawal symptoms: panic and/or anxiety. The two reasons I was taking the SSRI's to begin with.

I should have done the research beforehand to know that the medication has the potential to make worse the symptoms it is supposed to remedy.

In the end, therapy did way more for me than those pills ever did.
SQLite is included in most operating systems by default. It's also on macOS and iOS.

It also runs on all kinds of embedded devices in addition to personal computers and servers.

https://en.wikipedia.org/wiki/SQLite#Operating_systems
I was quite impressed at their competence and moderation during the reconquest of Afghanistan. They managed to take the country swiftly, with minimal bloodshed/destruction and while keeping some existing structure/bureaucracy in place with a relatively smooth passation of power. The whole "siege" of Kaboul was a masterstroke, let the West and those that want to leave, leave in peace, don't do anything rash, secure the capital as the government/NATO troops retreat, ensure the peace and calm, don't impose your new measures all in a sudden, try to get back to "normal" as quickly as possible, ....

At this point, they have international legitimacy: the West gave them the country knowingly and unless the Taliban do something particularly stupid, they aren't coming back anytime soon, China and Russia look keen to deal with them, the former Afghan government yielded the power "gracefully". If internal strife is kept minimal, at this point they have a strong and stable platform to change things. Let's hope they use this newfound stability for the better of the whole population and have a Vietnam-like trajectory.
Maybe you are mixing intelligence with jaded people? I mean if you are in a team and nobody wants to do the hard work, they will probably realized something extra that you haven't or you just have more ambition than your peers and actually want to work. In mega corporations there are all kinds of talented and motivated people, some people just want to coast at work and that's probably ok.
and you'd have no battery inside an hour.

watch words are simple to listen for, generalised transcription is far harder.
Exactly, that’s the scary abuse scenario where people could send a whole load of this stuff to e.g a political enemy.
The traps require antibodies specific to the virus, so what's the advantage of this over other antibody therapies? Producing antibodies for therapies is expensive enough and producing DNA origami may not necessarily scale.
I suspect this has a lot to do with the architecture of git allowing relatively "dumb" servers. To run a git server, you only need the capacity to receive, serve and compare git hashes and blobs.

For SVN at least (last I used it), the server is expected to perform all sorts of potentially expensive operations (esp. for large repos): diffs, merges, branches, etc. since the client does not have the full repo/history. Given at the time computing power was less cheap, it would mean that hosting SVN services incurred a non-trivial cost.

(And IIRC CVS was so bad that I don't think anyone in their right mind should actually try to host a free/cheap service around it.)

Also, initial versions of SVN was released around 2004, while git 1.0 was technically in 2005. It took a while for people to get used to git, but given its technical superiority (and its momentum given Linus' approval) and being less demanding on the server side to host, hosting for git was a correct decision to make anyways.
Yes CSV sucks, but beyond that this rant is...quite sloppy. In dismissing YAML and JSON it seems to confuse probability of corruption when using an editor that isn't structure-aware with “lack of precision”, and then treats binary formats as better in this regard. Not only is the terminology bizarre, but the application of the criteria is nonsensical. Binary formats are not less likely to be corrupted when using an editor that isn't specifically aware of the format, and JSON and YAML (especially when accompanied by explicit schemata) are no less amenable to structure (and, when used, schema) aware editors than binary formats are.

> To usurp CSV as the path of least resistance, its successor must have equivalent or superior support for both editing and viewing

Since the author has already ruled (on spurious grounds) human readability and thus the usability of ubiquitous text editors as incompatible with requirements for a successor format, this is simply impossible.

> If Microsoft and Salesforce were somehow convinced to move away from CSV support in Excel and Tableau, a large portion of business users would move to a successor format as a matter of course.

Yeah, sorry, you’ve put the cart before the horse. Neither of those firms are going to do that until the vast majority of users have already migrated off of CSV-based workflows, it would be an insane, user hostile move that would be a bigger threat to their established dominance in their respective markets than anything any potential competitor is likely to do in the foreseeable future.
Check out samsung products - they're top of the line and many apple products have a Samsung counterpart that's as good or better?
Haha no, but it has definitely help me to hide embarrassing images from my youth on Google ;) It only show images from Rushmore
There’s little point in E2E encryption if snooping is moved outside of either end. This measure is only necessary for implementing E2E in iCloud insofar as it allows the feds to do the very thing I want E2E to prevent them from doing in the first place.

It’s as if USPS invented a new type of envelope that is physically impossible to open for anyone whose name is not written on the outside of it. Just one caveat: before they’ll give you any of these envelopes, you must allow them to read the letters being put inside.

If your concern is someone intercepting your mail before it gets to its intended recipient, this is great news. If your threat model involves federal agencies reading your mail, you’re no better off than you would be without these fancy new envelopes.
If I think of the neural hash applied to government the obvious use is that one would make a database of classified photographs and images.

If somebody had those and wasn't supposed to have them than that would be a basis for action.

Other than that I don't know what set of images you'd be concerned that government employees had, but if you did have something that "went viral" in some way you could trace where it went.

In general you should look at the methods that are used to verify nuclear weapons disarmament. There is a big literature on this: the US and Soviet Union have all kinds of methods they use to prove that they are conformant with arms agreements while keeping as many secrets as possible.

That kind of thinking could be applied to other domains.
Yes, but, this is sort of "priced in" so although your waste is measurably radioactive it enters the same stream.
You have a throw away at least mention which one it is!
Covid-19 Booster Shot to Be Offered to Americans Fully Vaccinated
Necessary ... for the US government? Definitely not for me.
Very cool. I work from home in my basement and would enjoy such a device. Any plans to sell them? Or know of similar devices? I could probably build one, but most likely would end up in pieces next to my other random projects…
Caffeine is often used as that free "marker chemical" for tracing where sewage ends up.

https://www.semanticscholar.org/paper/Determination-of-caffe...
Do you want to go and stage some awareness campaign to tell people not to flush their meds and hope they don't, or would you rather we be proactive about the reality we're in and do something about it now?
IQ is kind of a weird metric to measure people by. Do they get their shit done?
sorry but if you're calling your colleagues "below-average IQ people" you're just an asshole
I was curious how big of a deal this would be in a real-world attack (eg could someone use this to DDoS Apple's human reviewers?) so I ran the colliding images through another feature extraction model, OpenAI's CLIP, to see if they also fooled it.

They don't; I think it'd be much harder to create an image that both matches the NeuralHash of a CSAM image and also fools a generic model like CLIP as a sanity check for being a CSAM image.

I wrote up my findings here: https://blog.roboflow.com/apples-csam-neuralhash-collision/
You can write what "looks" like CSV to you, but there are no guarantees it will import correctly.

The problem is 10x worse when you get CSV from one source and rely on another process to load it. I fought this problem for several days going from NetSuite to Snowflake via CSV.
But they won't be my private photos, the only way it gets to the point where a human see's them is that I have a bunch of child porn uploaded into iCloud, or someone puts a bunch of these grey blob images into my library. Neither of those are my images. There is no chance 30+ of my personal images have hash collisions with this database of child porn.

> How society went from keeping personal photos private

Also, didn't the local photo development shops used to call the police quite frequently when dodgy images were sent in to be developed? I remember it happening once at our local supermarket.
And if you have iCloud Photos turned on, those images are already being uploaded and then CSAM-scanned on Apple’s servers. The chain is just being configured differently, but this risk is already active.
Colonial Caste System of the Spanish Empire in Americas
These are Government staffed organisations, and incompetence is always a possibility.
> paid health care

Virtually all US programmers get 2+ weeks off plus 10 holidays and company-paid employee health care, and always have. Some also get paid or subsidized family health care.
> > Apple hashes all of your photos offline [...]

> No, only the ones designated for upload to iCloud.

How do you verify that?
Speak with your manager or manager's manager that your current team is not the best match for you (if you don't trust your manager). Your manager's manager is incentivized to keep you inside hes team even if you switch managers.
Thanks! Yeah, the Xavier NX was way more powerful than what I expected!
The linked post has plenty of evidence, it might be worth going through it.
JFYI Google left China. Not sure about Russia. Anyway that's not an excuse for implementing such a neat surveillance tool.

Fortunately for now you have some escape hatches.

I believe that it would be a smart move for everyone to stop paying for nooses for their own gallows and start investing into privacy. There are some realistic ways to do it, just buy a damn Fairphone for a no-brainer start.
Using ML and Optimization to Solve DoorDash’s Dispatch Problem
Thanks, it was a fun project!
I too was reading the article and wondering "why..." until I saw the mention of addiction. This is an excellent reason to write a complete operating system from scratch, congratulations to the author.
Like all vaccines, they were tested in animals and subsequently by human volunteers _before_ reaching the Phase III clinical trials. Those are double-blind, randomized, placebo-controlled experiments which are generally considered the gold standard for medical testing which test cohorts of people who are exposed to the threat and compare both positive and negative outcomes across those populations without either the recipients or the experimenters knowing which people are in which group until afterwards.

https://www.sciencedirect.com/science/article/pii/S0264410X0...

> An adjuvanted recombinant vaccine (LYMErix™) has been approved in the United States for the prevention of Lyme disease in adults, and has demonstrated both safety and efficacy. A clinical trial of over 10 000 adults showed 76% efficacy following the third dose of a 0, 1, 12 schedule. Accelerated schedules demonstrate equivalent levels of protective antibody. Up to 100% of children 2–14 years of age achieve seroprotective levels of antibody. Booster doses induced protective levels of antibody in more than 96% of recipients when administered at months 12 and 24. Only mild or moderate, transient vaccine-associated adverse events have been reported after immunization. The vaccine is a safe and effective method of preventing Lyme disease.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2870557/

> The OspA vaccines proved effective in animal models and safe in human volunteers [18]. Both manufacturers conducted clinical trials in a race to gain the first license for their vaccine [19, 20]. In the LYMErix™ phase III safety and efficacy trial, researchers enrolled 10 906 subjects between 15 and 70 years old who lived in endemic areas and randomized them to receive either the three-dose Lyme vaccine regimen or placebo injections. Vaccinated individuals showed a 76% reduction in Lyme disease in the year following vaccination [20], with no significant side-effects noted. Based on these promising findings, the U.S. Food and Drug Administration (FDA) approved LYMErix™ on 21 December 1998.
Exactly. Worst case a CSV can be edited and viewed or even created in MS Notepad or any other text editor which is pretty much guaranteed to be on a system. Something to deal with Sqlite? No such luck and the barrier is much higher.
People really aren’t capable of conceptualizing how intimate normal data collection and analytics are capable of being. You think your phone is listening because you assume that’s the only way the ads can know so much, and ironically the truth is far more invasive.
Correct, and those methods of escaping are clearly defined in both specs. In CSV, there is no universal escaping system. It's all over the board.

Any variable length text data format is going to run into issues when special characters are used in the data. CSV has no definition of what should happen when that occurs.
How to Generate Customized AI Art Using VQGAN and CLIP
I wonder if you have to push the button or if it could auto-cycle at some interval. Powering is always interesting do usually need a dedicated power source like a wall plug less you had some other means to get power. Low energy/battery/harvesting maybe (I saw this runs on a Jetson).
> I really want to support science and probably some combination of drugs in the above studies work. It's just hard to know which ones

Agreed, and thanks for the reference. Here are some promising results from a well designed and recently completed RCT evaluating Ivermectin in combination with doxycycline [1].

[1] Ivermectin in combination with doxycycline for treating COVID-19 symptoms: a randomized trial
https://pubmed.ncbi.nlm.nih.gov/33983065/
Great post. One of the reason the 9/11 wars went so badly is because the concept of "war profiteering" had almost entirely disappeared from American politics by the 2000s. Or at least the political will to combat it was gone.

When there was a draft and people were invested in the outcome of the wars, politicians made their names by going after war profiteers.
Again, how can you verify that's what they'll do?
What I think is funny: There are more privacy for consumer laws for Chinese tech companies in China than for US tech companies in USA! It's wild west essentially in USA in this regard. I'm sure what Apple is doing is also against the European Union's GDPR privacy laws. US is missing out here...
FTC Cybersecurity Compliance, GLBA, FCRA, and SEC
No, but you could possibly suggest to them that what they are producing is not CSV. Otherwise, any sort of description becomes meaningless.
> we're just speculating for possible reasons why this might be OK.

Sure. All the statements about why it’s not ok are also just speculation.

> why not release both features at the same time

That’s not how Apple typically works. They release a feature, try to make sure it works as expected and only then release the features that depend on it.
Brain wiring linked to age, sex and cognition
We need to talk about the Taliban's Twitter account again. [0]

> How long until Twitter realises that they have broken their own guidelines by allowing a listed terrorist organisation to have an account that posts content that incites violence and has a history of such brutal killings and attacks?

> Will they wait for another person to die for them to act like they always do?

Day 0 and a killing already after their 'peaceful takeover' Come on.

Can you NOW ban them for violence Twitter? [0]

Downvoters: So you want known terrorist organisations like The Taliban, ISIS and Al-Qaeda to have a platform on social media so they can spread their extremist messages, violent and barbaric attacks in their social media posts?

I don't know who in the world would defend such uncivilised creatures who cannot be reasoned with.

[0] https://news.ycombinator.com/item?id=28217867
1. open(2) doesn't care about the file format

2. Yes, mixing formatting with data slows down data processing, don't do it.

3. Excel is not the replacement for CSV, and CSV is not a compact format. I mean, maybe if you are used to XML it is, but otherwise, just no.

Yes, there is truly a problem.
Are we talking about the major company that is happy to give access to all of their users content if the country (eg China) asks? If they were really serious about privacy they would not operate under those conditions.
So do AC-DC converters. They rectify the incoming AC, then it’s basically the same as a DC-DC converter. They have a switch that produces basically PWM in the hundreds of kHz to low MHz range, that it punches through a transformer.
I think both are relevant. States have many differences and more or less progressive structures, but average revenue/spend tells an important part of the story.

If a state (e.g. California) is collecting and spending 50% than average on a per capita basis, it begs the question of what that money is spent on, and if there are diminishing returns in value.
> For those unfamiliar with German, they read numbers aloud in a unique way. 65536 is "sixty five thousand five hundred six and thirty" (Edit: this is inaccurate). I present German-endian as a common enemy!

What's unique about that?

Sing a song of sixpence, a pocket full of rye

Four and twenty blackbirds baked in a pie

When the pie was opened, the birds began to sing

Wasn't that a dainty dish to set before the king?
Well, as somebody who has travel to China for business, I would not touch any Chinese hardware or OS at all. In the US and EU you have a working legal system.
I think the gray blob refers to engineered hash collisions, like the example in the article link.
Thank you for the clarification.

> But there is no computable version for a non-computable real number, x_real.

That's true[0]. But consider that you will never receive something non-computable as input to a program, ever. (if you're allowed to approximate the input until you have enough digits to compute what you need, then the input is computable)

Really, I think the best way to view sin(x) is as a function that receives a stream of digits 0.2345345323.. and returns a stream of digits 0.0040933884... - this computable version of sine completely captures every thing we could possibly do with it in a program. Operating with floating point numbers, then, is just mostly truncating the input and output stream.

[0] At least in classical logic; in intuitionistic logic, sin : Real -> Real is computable and is equivalent to this idea of receiving and returning streams of digits.
> The author is not forced to use csvs.

The author appears to be a consultant selling data prep/transformation services. As long as the market is using CSVs, he’s forced to use CSVs, at least as end-of-pipeline inputs and outputs.

Of course, “people optimize their workflows for something other than making my job easy” is a common, but also rarely persuasive in motivating action from others with different jobs, complaint.
Yeah I don't understand this idea that Google is all of that.

With any company of any size the scale of grunt work / tedious maintenance and troubleshooting old stuff is going to grow massively.

Being Google or anyone will not change that.
Air pollution from household products is cutting people’s lives short
Things will be very team dependent at large companies.

I worked at some seemingly boring defense contractors on paper, but had a really cool team, and worked on a hard problem set... We all gelled well and everyone was smart.

But I also know if really dysfunctional teams at large companies that would otherwise sound exciting and interesting on paper...