skysight-inc/HackerNews huggingface dataset:
You inspired me to come up with this conjecture:

The number of correct papers grows logarithmically with the number of papers published.
They can upload any software to iPhones that they want. They may not create the database of hashes, but they can choose whether their software uses that database.
It seems the only way it could not be a weapon is if the unintentional side effect was coming from some other kind of device (ex. surveillance) that is also specifically targeted at U.S. diplomats.

Surveillance of diplomatic missions does tend to use cutting edge technologies, so that's not entirely improbable, but if harming people wasn't the goal then it seems they would be concerned about it drawing attention to their technique.
TI makes some DSP chips with a dedicated peripheral (basically just a high resolution timer with some fancy capture/compare units) for doing PWM for power supplies.

Supposedly it can also detect shoot-through and modify timing to compensate.
How do you push spreadsheet data into GSlides?
It’s just a more advanced version of those MySpace quizzes from 2007. Same thing, just in a shiny React app.
What kind of social engineering would lead an innocent person to install malware on their devices? Or do you think people like that want to take part in an illegal DDoS botnet?
A poster upthread made an analogy that I really like. Sure, like all analogies, it's imperfect, but I think it strikes at why many people are uneasy about this.

Let's say the TSA were to install air-travel-contraband scanners in everyone's homes, but promise only to scan things that are being put into your luggage as you prepare to go to the airport. And let's say that this became a requirement if you want to board a plane.

That's what this feels like. I'm fine with Google scanning through everything in my GMail account, or everything I've uploaded to GDrive, or created in GDocs. That stuff is on their servers, unencrypted, and I explicitly put it there.

But I'm sure as hell not going to let Google install something on my laptop (or phone!) that lets them look at my stuff, even if they pinky-promise that they'll only scan stuff that I intend to upload.
Isn't the design of this system enough of a canary?
AFAIU, there are still zero (0) consumer banking APIs with Read-Only e.g. OAuth APIs in the US as well?

Banks could save themselves CPU, RAM, bandwidth, and liability by implementing read-only API tokens and methods that need only return JSON - instead of HTML or worse, monthly PDF tables for a fee - possibly similar to the Plaid API:
https://plaid.com/docs/api/

There is competition in consumer/retail banking, but still the only way to do e.g. budget and fraud analysis with third party apps is to give away all authentication factors: u/p/sqa; and TBH that's unacceptable.

Traditional and distributed ledger service providers might also consider W3C ILP: Interledger Protocol (in starting their move to quantum-resistant ledgers by 2022 in order to have a 5 year refresh cycle before QC is a real risk by 2027, optimistically, for science) when reviewing the entropy of username+password_hash+security_question_answer strings in comparison to the entropy of cryptoasset account public key hash strings:
https://interledger.org/developer-tools/get-started/overview...

> Sender – Initiates a value transfer.

> Router (Connector) – Applies currency exchange and forwards packets of value. This is an intermediary node between the sender and the receiver. {MSB: KYC, AML, 10k reporting requirement, etc}

> Receiver – Receives the value

Multifactor authentication: Something you have, something you know, something you are

Multisig: n-of-m keys required to approve a transaction

Edit: from
"Fed announces details of new interbank service to support instant payments" https://news.ycombinator.com/item?id=24109576 :

> For purposes of Interledger, we call all settlement systems ledgers. These can include banks, blockchains, peer-to-peer payment schemes, automated clearing house (ACH), mobile money institutions, central-bank operated real-time gross settlement (RTGS) systems, and even more. […]

> You can envision the Interledger as a graph where the points are individual nodes and the edges are accounts between two parties. Parties with only one account can send or receive through the party on the other side of that account. Parties with two or more accounts are connectors, who can facilitate payments to or from anyone they're connected to.

> Connectors [AKA routers] provide a service of forwarding packets and relaying money, and they take on some risk when they do so. In exchange, connectors can charge fees and derive a profit from these services. In the open network of the Interledger, connectors are expected to compete among one another to offer the best balance of speed, reliability, coverage, and cost.

W3C ILP: Interledger Protocol > Peering, Clearing and Settling: https://interledger.org/rfcs/0032-peering-clearing-settlemen...
OK, I work at Plaid and I feel like I have to jump in here -- while it's true that we've iterated on the Plaid Link UI over time and it hasn't always looked like it does now, you can see what the login screen currently looks like here: https://plaid.com/plaid-link/ and here: https://plaid.com/demo/

IMO it does clearly tell end users that they are connecting to Plaid.
I wouldn’t be sure about that, the phone companies already have a legal obligation to allow wiretapping and the government is very happy to put gag orders on this stuff.
EdX had an extremely good one that teaches physics and biology via cooking. The thermodynamics of food and biology of fat/sugar/nutrition.

https://www.edx.org/course/science-cooking-from-haute-cuisin...

It looks like it's focused on chemistry now, though. You might find something suited on EdX.
Offbeat Computation Club Meeting Log
“And for now” is not a particularly strong argument because it applies to literally anything that software could ever conceivably do on an iPhone, because Apple has the ability to release any software updates they want.
No, the client doesn’t have access to the CSAM hashes. And matches are verified on the server, not on the client.
You must be a champion CAPTCHA solver.
As printed above, I'm not writing software where that would be a problem. In general if I was writing a commercial application or something in production where I don't control all the inputs I would agree 100%, but I'm lucky to not have those problems. I could use a bunch of libraries and additional code to try to catch non-existent errors I don't have, or fix my actual problems and move on.

I appreciate the perspective though for sure. I'm guilty of the same thing on HN, where I assume people have the same uses as me when they're writing code that has to be extremely robust or blazingly fast.
I think you misread what was meant by "target".

Yeah, Apple might be able to look at the uploaded image. But the reviewers don't have a copy of the original image added to the database, which is the "target".
Ask HN: Which computer geek wrote a guide on dating for nerds?
I remember coming across a guide to dating written by some famous (or semi-famous) programmer some time ago. I think it was shared here, but I can't remember.

I know it had a humorous tone to it. Thought it would be a fun read but I never got around to it and now I can't find it. Hoping someone here knows what I'm talking about!
Aweber review; the ups and downs of the Software
Show HN: Job Board for Rust Developer Skills
Clearly, for there to be chronic scientific progress, there must be some value in experimental practice. And yet widespread irreproducibility of results negates that value, by definition.

So, where is the progress coming from?

Your argument that "there must be a robust and explanatory theory that goes along with experimental results" helps make sense of TFA, which otherwise presents as a paradox, or a ruse to excuse shoddy practices.

The presence of a viable theory is a useful heuristic for sorting useful experimental practice from less useful. At least, I imagine it is. How can we know for sure?

Has anyone published a meta analysis that checks for this?

And has that meta analysis been independently reproduced?
On two occasions in my career (most recently just a few years ago) I have for various dumb reasons ended up working 99% out of a single terminal ssh'd into some other machine for significant lengths of time. Screen + emacs gets it done.
> Powershell seems like you have to have a browser open to accomplish anything. Inexperience sure, but nobody could learn enough Powershell and remember it to be productive.

I could level exactly the same criticism against Unix shells, as someone who has used them for over 10 years. I usually either can figure out the command easily, or I have to Google for a Stack Exchange answer.

That said, I agree with your point about the GUI. It seems to me that at some point during the past decade, Windows has gone from an environment where everything is configurable with a GUI and maybe a registry key, to an environment so heavy on mandatory CLI usage for configuration that it's becoming indistinguishable from Linux in this aspect. To be clear, this is a bad thing for those who prefer the GUI approach.

I understand that you see PowerShell's divergence from Unix-ness as something weird, but really I think that an (optionally) structured data output format cannot come to Unix soon enough. Parsing things with tr, awk and cryptic command line switches is a notorious Unix weakness that PowerShell (and some native Linux shells) solves quite easily.
But it sounds like a very very good approach.
I'm sure apple would like everyone to call their trojan that way. "Feature Flag" lol.
Do you mean charging the sender of the trick images or the receiver?
Your examples of conspiracy (masks and lab leak) seem pretty inconsequential. We were told masks were in executive for the whole of a few weeks before the official position changed. Regarding lab leak or not, the original consensus was that it is not a man made virus. That is still the consensus. Somewhere along the way, media and politicians construed not man made to mean "could never have been in a lab or had any work done to it".

If those two things made you completely open to all kinds of conspiracy theories, it didn't take much.
Complete guide to understanding Node2Vec algorithm
I started to use it for a sideproject a month ago and it works like a charme. Thanks for that
Yeah, why is it a "bad analogy"? I think there's something useful in it, possibly even essential.
And this is just one step away from Apple and Microsoft building this scanning into the OS itself (into the kernel/filesystem code, why not?!). This is beyond insane. Stallman was right. Our devices aren't ours anymore.

Now, to be fair, there would be a secondary private hash algorithm running on Apple's servers to minimize the impact of hash collisions, but what's important is that once a file matches a hash locally, the file isn't yours anymore -- it will be uploaded unencrypted to Apple's servers and examined. How easy would it be to shift focus from CSAM into piracy to "protect intellectual property"? Or some other matter?
Please read what is written right before that... You are taking something out of context.
Yes. There are no plans for binary module compat between compilers, or different versions of the same compiler for gcc and Clang.
Really fun stuff, perhaps you should use a computer screen instead of producing one
Or tweeting out a bunch of them. They're just 12 byte numbers.
Approximately 206? How about approximately 200?
I would gladly have a mobile phone full of memes that have been modified to match, just for the lulz. I honestly think every meme should be put through just to have "illegal memes"
> But OK, say someone sends you a sunset that fools the hasher. Then what? Of course one match won’t do anything, so you’d need to download however many matching sunsets. Then what?

A real attack would be to take legal porn images and make them collide with illegal images, so when a human goes to review the scaled down derivative images, those images very well look like they could be CSAM. Since there are many of them, they'd get sent to law enforcement. Then law enforcement would raid the victim's home and take all of their electronic devices in order to determine if they can be charged with a crime or not.
If you pwn the telco, and the bank has poor password recovery policiss, you might be able to just recover the password. Or maybe password reuse, etc.

I assume if you pwn a bank, you don't really need 2fa codes, but I dunno
Nowadays you can do it with Alpaca.
> And since Apple certainly has the capability, they are likely one secret court order away from being required to scan even photos that aren't being uploaded, at least on some targeted subset of devices.

Apple has the ability to upload literally any software to iPhones, so this argument applies equally to literally any conceivable bad thing that software could do on iPhones.
What were your returns on this strategy?
There's already a problem that Apple can't verify the hashes. Say a government wants to investigate a certain set of people. Those people probably share specific memes and photos. Add those hashes to the list and now you have reasonable cause to investigate these people.

Honestly this even adds to the danger of hash collisions because now you can get someone on a terrorist watch list as well as the kiddy porn list.
> Just being out on the highway waving a flag is a sphincter workout.

Had a good chuckle at that one, thanks.

> "big steel plate" is a bit more realistic than spray foam, but think about how that has to be secured

Yeah the bottom line is civilians are not qualified or authorized to repair a road.

FWIW many states have a department of transportation website that has a specific form where things like potholes or graffiti on traffic signs can be reported. In the case of Arizona, it appears you have to use their generic contact form [1].

Also you can be reimbursed for damage caused to your vehicle due to poorly maintained highways or state roads, like the one in OP. Be sure to take photos, then file a police report. The state may deny your claim, in which case you should be prepared to escalate the issue to your insurance company.

[1] https://azdot.gov/adot-blog/have-question-or-concern-adot
Which is basically what Bob Frankston did in the 60s which is where the idea came from to do it interactively. Hence the Visi part of the name.
ActiveCampaign; the Positive and Negative Side
I've used Google Voice from before it was even Google Voice, it was called Grand Central or something and they gave me free business cards with my number on it.

GV has always been a red headed step child product. It doesn't work natively with any android smart watch, its integrations into other products is sketchy and flaky (like there used to be a google voice widget for gmail). Features have been slowly deteriorating for years. The only reason I still use it as my main number is that it's easy to text in my browser. I don't know if that's easy to do with carrier websites but I've certainly never seen them advertise it.

It's 2021 and I still can't get video texts on GV. Well, I can, but they're literally less than 240p resolution. To the point it's difficult to even tell what's happening. And before potato quality, it was flat out not an option for like a decade when every single phone supported it.

Group texting also seems to not really work, and the "reactions" people on iphones use aren't supported.
Where on the spectrum is RenTech?
I don't see how this is fixable on their end.

Several people have suggested simply layering several different perceptual hash systems, with the assumption that it's difficult to find a colliding image in all of them. This is pretty suspect - there's a reason we hold a decades-long competition to select secure hash functions. Basically, a function can't generally achieve cryptographic properties (like collision-resistance, or difficulty of preimage computation) without being specifically designed for it. By it's nature, any perceptual hash function is trivially not collision resistant, and any set of neural models are highly unlikely to be preimage-resistant.

The really tough thing to swallow for me is the "It was never supposed to be a cryptographic hash function! It was always going to be easy to make a collision!" line. If this was such an obvious attack, why wasn't it mentioned in any of the 6+ security analyses? Why wasn't it mentioned as a risk in the threat model?
The JavaScript Ecosystem
If folks are at all interested, ideas that are directly related to the point the author brings up have been studied quite in-depthly, both theoretically and empirically, in the human capital econ literature.

Gary Becker's lecture on Human Capital is a fantastic survey of the field (which he in part invented):

https://www.youtube.com/watch?v=QajILZ3S2RE&list=PL9334868E7...
My first thought was, “this looks a lot like screenhero”. Glad to see y’all are back!
Sadly, every hosting platform attracts fraud. It's a very difficult problem to prevent and the payoff when people break through fraud prevention is quite high.
The point is that turning it off resolves the issue, but if someone refuses to turn it off because they want to use iCloud there’s clearly a contradiction.

Therefore you must trust Apple. So if you still have issues then you don’t trust Apple.
I'm fairly sure they do, actually. It was in one of the articles earlier today that Apple has a distinct, secret algorithm they perform on suspected CSAM server side after it gets flagged by the client side neural hash. Then only after 30 such images from a single user are identified as CSAM by both algorithms will they be sent to a human reviewer who will confirm their contents. Then, finally, law enforcement will be alerted.

There has been a lot of hyperbole going around and the original premise that this is a breach of privacy is still true, but in my opinion the actual repercussions of attacks and collisions are being grossly exaggerated. One would have to create a collision with known CSAM for both algorithms (one of which is secret) which also overlaps with a legal porn image that could be misconstrued as CSAM by a human reviewer, or at the very least create and distribute hundreds of double collisions to DOS the reviewers.
Uhm, strike prices are not option prices.
People are pretending it scans everything on your device. This conversation is already bad enough without adding additional confusion over what this does.

I don't have a problem if it scans everything, but its not. Let's stick to what is doing. Android could do this as well, so talking about what companies like google could do is not so interesting - they could do almost anything.
By raising five-eyes, you are suggesting that another country could launder the request on behalf of the USA in order to circumvent the 4th Amendment. Okay then, let's play that out.

Australia demands that Apple augment CSAM detection so that every iPhone in the USA starts scanning for (and reporting back to Australia about) some other set of images. There's absolutely no scenario where Apple wouldn't walk out of the room laughing.

End of hypothetical.
not only screen scraping. Plaid also gets around 2FA by asking to forward the bank sms code to them. It happened when i tried using Expensify recently.

That is unacceptable and goes against everything I know.
I’m agreeing with you.

“ The only time I’ve been let into a bar without showing ID…”
It happens on instagram too of course. Start scrolling then its just suggested reels and posts are all major accounts with with thousands of followers which comes with some commercial angle.
There was a time when NetBSD's portability was impressive. A handful of open source operating systems supported a handful of architectures, then there was NetBSD (and OpenBSD). Then Linux started to look beyond the x86 and started gathering steam on other architectures. NetBSD couldn't really compete for developers and it began stagnating. It probably didn't help that a lot of the "Unix" userspace also became more tightly coupled to Linux.

Don't get me wrong: I was enormously enthusiastic about NetBSD in the mid-1990's and I still prefer the idea of a unified core OS. The thing is, it's a lot easier to deal with one operating system than multiple. If you're developing under Linux, it's going to be easier to develop code for an Arm based system under Linux because it defines your expectations.
Currently, most likely.

I don’t believe Apple has said whether or not they send them in their initial referral to NCMEC, but law enforcement could easily get a warrant for them. iCloud Photos are encrypted at rest, but Apple has the keys.

(Many have speculated that this CSAM local scanning feature is a precursor to Apple introducing full end-to-end encryption for all of iCloud. We’ll see.)
> I named it “Screen” as homage to Screenhero, only to realize that such a generic word makes a terrible brand name, and consequently makes it impossible to find via search engines.

So you've changed it to "pop"? I don't think you're going to get any better here..

Btw I'm an old fan of screenhero.
How do I set up IIS to debug classic ASP?
How do I set up IIS to debug classic ASP?

Help Needed Setting up Classic ASP Debugging

According to what I have seen on social media, in order for me to set up my computer for writing and debugging Classic ASP, I need to set up IIS a certain way -- which I did -- and then I have to enable ASP by doing the following:

IIS7 - IIS > ASP > Compilation > Debugging Properties > Enable Server-side Debugging

And I am stuck on this. Please, someone give me an idea of what I need to click on.

https://i.stack.imgur.com/xOwwt.png
I think visual derivative is just a beating-around-the-bush way of saying “thumbnail.”
Sounds "simple" enough for an organism to evolve a defense system like this. Why it isn't present in current living forms after millions of years of evolution? Or if it ever existed, maybe it devolved.
Ask HN: Toys for pets that are too smart
This may be a bit outside HN norm.

I’ve been blessed/cursed with a couple of young cats that are entirely too smart, energetic and curious for my or their good.

I’m starting to work on a automated laser pointer controlled by motors/RPi, but that’s taking time.

Are there commercially available toys that are good for bored, intelligent, energetic young felines?
I posted the reply as a top-level comment, but the very questions you bring up are issues that some econ fields have taken seriously and have tried to model it empirically and test parts of it empirically. The observing all of this is a lot of where the complexity lies, as you rightly point out. If you care at all to poke further, I posted a link to a lecture series which will talk far more about this than you'd ever want to hear.
This is the right suggestion.
Well done! Hopefully all of this progress toward demonstrating how easy it is to manipulate neural hash will get Apple to rollback the update...
I think there’s a difference between “I’ll click this totally legit button to protect my computer from viruses” and “I’ll save this picture of a child being raped to my photo library.”

A lot of people may not know how to avoid malware. But I don’t think very many of them would be so inept as to accidentally long press on child porn and tap “Add to Photos”.
So you are a postdoc at Uni?
A million dollars to Bezos is like $1 to most of us.
> First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database.

https://www.apple.com/child-safety/pdf/Security_Threat_Model...
Q&A [with Marc Petit of Epic Games]: Why the Metaverse Needs to Be Open