skysight-inc/HackerNews huggingface dataset:
> It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached.

Wise (formerly TransferWise) is another example. You have to move funds into your Wise account before you can do a transfer, payment, or currency exchange. Wise offer various ways to fund your account such as wire transfer, credit card payment, debit card payment, etc., each of which has different fees, but by far the lowest fee is "direct debit" which involves giving Wise your bank card number and password. I imagine that the overwhelming majority of Wise customers have no idea that this is terrible for security and privacy.

Everything about this practice is hard to believe:

1) I doubt that any bank has given Wise permission to do this.

2) Which raises the question about why the banks aren't blocking IP addresses that Wise uses to log into bank accounts, or at least making a complaint to Wise.

3) It's obviously against the banks' terms of service, but Wise may be breaking some law regarding unauthorized access (in the same vein that you can't authorize a third party to use your passport, for example).

4) What else is Wise doing after they log into your bank account? Are they collecting other information about your transactions and balance?

5) Does Wise store your bank card number and password? If they do, they'd have to store it as cleartext (not as a one-way hash) if they expect to use it again. They could encrypt it of course, but it would have to be reversible so they could get the cleartext back.

6) Why hasn't any bank regulator forced them to stop doing this?
Cant find any social media on Elizabeth Holmes
All I can find is a twitter account. Why is she leaving this up, but deleting all the others? I can't find her anywhere on social media. Its like she doesn't exist besides videos of press catching her walking into court.
I prefer boost json
I spent time there between 2012-2014.

At the time, Afghan gov’t spending was approx $16 billion with only approx $2 billion actual national revenue.

Which was a well known, but largely ignored, problem to anyone paying attention.

It’s unlikely China’s Belt and Road Initiative will generate similar frictional toll/rent cashflow opportunities in the short-term.

Debt-trap diplomacy tactics are unlikely to work as I reckon the Taliban would strongly prefer to continue collecting tolls/rents on commerce movement rather than borrow foreign money for domestic owned infrastructure.

Why fix what isn’t broke(n)?

I suspect China would need to be willing to lose circa $5-10 billion annually in frictional losses as rent to the Taliban to maximise odds of influence and stability.

Pakistan doesn’t have the financial capacity to guarantee Afghanistan’s success, only it’s continued failure.

India would struggle to rent influence due to a lack of excess financial capacity and geopolitical incongruence.

Iran has its hands full elsewhere and is probably focused more on ensuring Iran’s Shia diplomats aren’t slaughtered again.

In terms of natural resources, I recall the stories of Afghanistan’s half trillion under the dirt.

But it reminds me of the trillion dollar asteroids.

It’s irrelevant is the cost of extraction and bringing it to market exceeds the value of the resource.
They’re certainly not anonymous on FTX, you have to be KYC’ed both by the exchange and the institution doing the tokenizing. Maybe you can trade anonymously on a DEX somewhere?

Just being on FTX probably makes it much harder for the SEC to find the gains, though.
It was a while ago, maybe $4,000 - $5,000 ? I was definitely not more than $5,000. As I said above, I think it was more the timing than the amount that got them curious.
This is one of the most facile articles i have ever read on HN. Other than the click-baity title there is nothing in it. The author did not teach his kids to learn but taught them techniques to mug up and sort of feels good about it?
Imagine being a parent that made pictures of their own children that bathed naked in their own backyard.

I don't know about you, but my parents certainly have lots of embarassing pictures of me in their photo album.

There will be so many false positives in that system, it's ridiculous. It doesn't necessarily have to be a false colliding hash, but legitimate use cases that - by definition - are impossible to train neural nets on unless the data is being used illegally by Apple.
They're saying that a CSV equivalent should be strictly 2-dimensional, with "flat" values.

Such a format could contain arbitrary JSON in a "cell", but simply as text, in the same way as putting the same data in a CSV.
> [Andrey Shumeyko, also known as YRH04E and JVHResearch online] said he established a relationship with Apple's anti-leak team—officially called Global Security—after he alerted them of a potential phishing campaign against some Apple Store employees in 2017. Then, in mid-2020, he tried to help Apple investigate one of its worst leaks in recent memory, and became a "mole," as he put it.

> Shumeyko has never worked for Apple, [...] but he decided to give Apple information about the iOS 14 leak. He had obtained a copy of the leaked iOS 14 build himself, and said he also learned how the leak went down and wanted to share the information with Apple.

> Last year, Shumeyko sent Apple investigators a PDF titled "The List," essentially a dossier where he shared personal details such as phone numbers, WeChat IDs, and alleged locations of three people who advertised and sold devices on Twitter, as well as a U.S. citizen who collects iPhone prototypes.

> Shumeyko told Motherboard that he is still struggling financially. He is also still on Twitter trying to sell Apple data in an attempt to finally cash out on years of being involved in Apple leaks.

What we have here is a classic case of the age old proverb: "there is no honor among thieves". Shumeyko strikes me as particularly motivated by financial gain with no real allegiance to Apple or the jailbreak/leak community. It's a bit sad that he thought he would make legitimate money from any of this, but I don't feel much pity for him. It was a tough lesson for him, but for everyone else the takeaway should be: always get it in writing. Especially when you're toeing the line of legality and criminal activity.
You’re correct, but the uploaded image is sufficient as it would be obvious some that it isn’t CSAM material.

If it was, then would it matter if it wasn’t the original?
> If you want something better than CSV to take off, at the very least it needs to solve the common pain points of CSV. JSON doesn't - all it brings to the table is the ability to distinguish number vs text. That's a yawn.

It brings the ability to parse in parallel - that's a big deal. And while number vs text might not be a huge difference in theory, in practice it eliminates what, 95% of real-world parse problems?
I’m guessing the complexity of the bureaucracy is why most government IT contracts have to go through Carahsoft?
Courts can order them to collect data on users.
If you are looking for screenhero alternatives, you should check out Tuple! Our team has been using it for about a year now and we love it.

My favorite part about Tuple is how it HAS NOTHING that overlays the screen. It just hides in the tray.

I HATE when these screen sharing apps all try to put floating windows and menus and chrome around the screen edges. Just let me share my screen without getting in the way, dang it! Why is that so much to ask?
Elm's library ecosystem is a bit iffy in my experience compared to Haskell or Scala. Those two don't really have huge gaps nowadays, and they're buoyed by better FFI (Haskell w/C, Scala w/Java) than Elm's draconian JS interop.
Wouldn't the photo be scanned for CSAM by WhatsApp first?
Those were previously pretty productive and organized societies before the Allies took over. There was living memory of a functioning society for civilians to return to.

Afghanistan isn't like that. It has been more like a construction than a reconstruction.
I don't think this was a leak from the QBR. The QBR goes into a lot more detail around finances etc. Sounded like this case the person was just trading off of subscriber data, which has other sources besides the QBR.
People maybe but not the industry.
Jup. As others have pointed out, if Apple were willing to lie about the extent of this system and its inception date, why should we suddenly trust that they won't extend its functionality. They themselves explicitly state that the program will be extended, so if this is the starting point I don't think I will be around for the ride.

It's a shame as I really love some of their privacy-minded features (e.g. precision of access to the phone's sensors and/or media).
Ok, context is required here.

try {
int i = 0;
while(true){
someArray[i];
i++;
}
} catch (IndexOutOfBoundsException ex) {
//done
}
That's their words that they feel no need to elaborate on. Obviously they actually seem to just be doing the "technically the truth" thing - which shows that someone realized no one would like hearing what it actually is.
What abstraction did you use?
This doesn’t work for two reasons:
1) There’s no way to know the perceptual hash value of Apple’s private NeuralHash function that is run on the derivative of the image server side to verify a hit really is CSAM. So while you could cause a collision with the on device neural hash if you possessed illegal content, you wouldn’t know if you successfully faked Apple’s private neuralhash implementation.
2) An Apple reviewer must verify the image is illegal before it’s passed along to law enforcement.
FEDRAMP compliance isn’t cheap, and it’s not really something startups have the wherewithal of handling until they are a midsized company.
They are not doing this for the fun of it. If they didn't have to, they would not do it at all.

You have made a huge leap from scanning for pre-existing CSAM while in transit to a cloud service to scanning frame buffers on device in real-time. You should get some type of Olympic medal for such a leap.

This tech is to catch the lowest possible hanging fruit of the dumbest of all CSAM-sharing/saving folks as required by law.
Apple is the one doing the first line of investigation.
Tom Lehrer is quite good on this :) .
Twitter Introduces ROA
Well that's the product. Yeah, I can sit in $place all day and complete $tasks I need done. However, if there is someone that I can pay to do it for me, then it's a simple comparison: my time vs their cost.
What does Apple even do in this situation? That media won't match known CSAM, but if you modify childhood images so that its hash matches CSAM, what does Apple do. There are just SO MANY things that can and will go wrong as people try to exploit this system.
Hard to exploit is better phrasing.
Except that it isn’t. The hashes don’t enable an attack.
What an weird nonsequitor, of course not? It would make you eligible for all of the benefits that Uber gives to it's W2 employees though. Which is obviously the point.
It does seem to have a very similar interface to this and has the performance of RapidJSON. So a nice balance in that regard.
Microsoft is making it harder to switch default browsers in Windows 11
Yes, Skyrim's Foxes Do Lead You to Treasure, Sort Of
Sourcehut is still in alpha and I cannot trust it until it's out otherwise.
They will be if you collide a low-res image that resembles CSAM.

Why would person doing manual review risk his job in case if he’s unsure? Naturally he will just play it safe and report images.
A similar topic on YouTube by Kurzgesagt:
https://youtu.be/ulCdoCfw-bY
Keep in mind that you have to also collide with another perceptual hash function that only Apple has to trigger a match.
You can’t modify your childhood images so their hash matches csam because the visual derivative won’t match.
Bayesian statistics at play here...

Good explanation: https://www.youtube.com/watch?v=BrK7X_XlGB8

Imagine a world where there are 100 unvax and 9 million vaxed, now even if vaccines are 99% effective, you'd get 9M x 0.01 = 90k vax and sick.
Csv isn’t going anywhere for better or worse.
What would they be hiding?

If they wanted to hide any data, why not simply not post it?
I get what you're saying, but even within the more reputable sciences, the body of known or published results is peppered with results that will fail to replicate. They have not all been identified. There will be more. The good results are mixed with junk results yet somehow science progresses. The robustness of science has to come from somewhere other than the complete absence of junk results. This is what I meant by my first sentence.

I read that in the century after Newton, the French Academy offered a prize for evidence of the failure of Newton's laws. They gave out the prize dozens of times, yet Newtonian physics kept getting stronger and stronger. Eventually they stopped giving out the prize. Many of the contradictions apparently had to do with the lunar orbit, which was poorly understood.
Until when you retire you find out you paid to a system that was will reward you a small amount and you would pay taxes on that. Tell me about quality of life then!
As an SWE, id take US any day.
I think there's an argument to be made that some developers might be willing to sacrifice portability to some lesser-used platforms in order to make the ecosystem a bit cleaner for the platforms it does support. This is definitely a tradeoff though, so it make sense and is good that different ecosystems make difference choices here, as it allows people to choose whichever suits them best.
Photos in the database are classified for their content. Only images classified as A1 (A: prepubescent minor, 1: sex act) are being included in the hash set on iOS. So this doesn't even include A2 (2: lascivious exhibition), B1 or B2 (B: pubescent minor) let alone images which are in the database and aren't classified as any of A1, A2, B1 or B2.

While I've no doubt that there's a lot of "before and after" images (which are still technically CSAM even if they're not strictly child porn) and possibly many innocuous images, they would not have been flagged as "A1".

I'm sure there's probably still a few images flagged as A1 which shouldn't be in the database at all, but that number is going to be small. How many of these incorrectly flagged images are going to make their way into your photo library? One? Two?

You need 30 in order for your account to be flagged.
Not much to tell... old forum friend from back when forums were the big thing. We'd play videogames together that weren't too sensitive to lag in our off hours. She had a few stories from life there, I forget what her role was. At one point she got to shake the hand of the president and she showed me a picture of it. We lost touch and I have no idea what she's up to now.
Literally got bored of scanning through the hundreds of cookies to find the ones that have "legitimate interest" to individually turn off.

Hope the article was good!
US targeted ads on facebook cost a lot. Cannot imagine advertisers making a positive ROI , especially after accounting for fake engagement,but I guess some do
You can still hack someone's phone and upload actual CSAM images. That exposes the attacker to additional charges, but they're already facing extortion and all that anyway. I don't understand the "golly gee whizz, they'd have to commit a severe felony first in order to launch that kind of attack" argument.

Don't know why this hasn't already been used on other cloud services, but maybe it will be now that its been more widely publicized.
What happens if someone leaks or guesses the weights on that "secret" classifier? The whole system is so ridiculous even before considering the amount of shenanigans the FBI could pull by putting in non-CSAM hashes.
This is a classic philosophical argument that was dispensed with in the middle ages. The usual form of it is "how can you know what infinity is if infinity doesn't exist?" The answer is as simple as "I take the word finite and put the word not in front of it." We are perfectly capable of synthesizing concepts that do not exist in our experience of reality.
It seems like it maybe does a better job of handling video and audio than tuple does, and it looks like it plays nicer when there are multiple people involved.

For example, inviting someone to a screen sharing session is as easy as sending them a link.

It also has virtual whiteboarding, which Tuple doesn't have
The adversarial images have to match both the NeuralHash output of CSAM, plus another private perceptual hash that points to the same image that only Apple has access to, plus a human reviewer needs to agree it is CSAM, and this has to happen for 30 images.
Please email us at hello@pop.com so we can figure out how this happened and fix it asap!
Policy groups ask Apple to drop plans to inspect messages, scan for abuse images
They still seem to be under the impression that a neuralhash collision would be enough to do this, which it isn’t.
Tesla is prepping for giant Supercharger expansion ahead of opening the network
> its seems these new programs are more focused on teaching kids how to reason, and as a result ask them to follow the process instead of simply arrive at the answer

You don't teach people to reason by giving them a step-by-step guide that they can mechanically follow without thinking.

You teach them to reason - to think - by giving them a problem and having them figure out how to solve it themselves.

Math shouldn't be about rote memorization and imitating a calculator. You can fit all the basic calculation skills people will need in everyday life in grade one to three, then teach them proper mathematics - which coincidentally means learning to reason in a precise manner.
I don't understand at all how you got downvoted for posting this. Thanks for the tip, cheers!
> A hash collision allows you to create material that matches CSAM signatures, without being CSAM.

This is not correct. Hash collisions won’t match the visual derivative.
Pretty much the rfc. https://datatracker.ietf.org/doc/html/rfc4180

Parsers are trickier if you want to be lenient, but exporters are dead simple.
Jury is still out on whether advertising makes a difference at all, more so targeted ones.
Insurance companies may well drive (pun intended) the uptake. If self-driving cars are an order of magnitude safer, insurance can be an order of magnitude less expensive. (Or, more likely, human-driven cars will become an order of magnitude more expensive to insure.)
Yes but that would be harmless because the visual derivative wouldn’t match.
Photopea is so good it's one of the few sites I allow ads via ublock.

Try the pwa version as well. Feels like having photoshop for free.
Yes but the creditors / investors would gain control of that asset. Is this the best way to spend $1.5M as a startup?
Are you sure you're not confusing things? Direct debit usually means just a permission to charge the given account for the specified amount. It's commonly used in Canada and doesn't involve sharing your password.
Very cool website design, I like how the window theming changes with the decade you navigate to.

However the thesis presented is ... a bit nebulous. Maybe the point is to invoke nostalgia in general?

Here is the text from the main page and the other four pages:

> Thirty years ago, the world wide web was a way for scientists to share data. Since then, it’s become a critical force for industry, and how the world connects. But this didn’t happen all at once. The web’s evolution has been shaped by the geography of its creators and users. We explore the stories of people who have defined the web today, and what it means for the future.

> The early internet was an open-sourced Wild West brought to us via a tenuous dial-up connection. Part utopian experiment, part financial gamble, and much slower than any of us care to recall, the web during this decade was a petri dish for commerce and community that laid the groundwork for the internet we know today.

> In the new millennium, the trickling stream of information on the internet grew into a powerful river with the capacity to overwhelm. As more people came online, social networks made the world feel smaller, and companies that survived the dot com bubble began to compete with traditional businesses.

> Better, faster, smaller—in the age of the smartphone, the internet can travel anywhere. A task that once tethered us to our PCs now morphed into a mobile app. Suddenly, we’re always online, for better or for worse.

> As computer power increases exponentially, it begs the question: what can’t the internet do? The specifics may still be fuzzy, but the next few decades will almost assuredly see the internet increasingly integrated into our lives, our stuff, and perhaps even our bodies. That will undoubtedly make life easier and more complicated.
Despite that Apple scanning our images is
a horrible privacy practice, I don't get why
𝚜̶𝚘̶ ̶𝚖̶𝚊̶𝚗̶𝚢̶ some people think this is an ineffective idea.

Surely you can easily fabricate innocent images
whose NeuralHash matches the database.
But in what way are you going to send them to victims
and convince them to save them to their photo library?
The moment you send it via WhatsApp FB will stop you
because (they think) it is a problematic image.
And Even if the image did land, it has to look like
some cats and dogs or the receiver will just ignore.
(Even worse, the receiver may report you.)
And even if your image does look like cats and dogs,
it has to pass another automatic test at the server side
that uses another obfuscated, constantly-updating algorithm.
After that, even more tests if Apple really wants to.

That means your image needs to collide ≥ three times,
one open, one obfuscated, and one Turing.

Gmail scans your attachments and
most people are cool with it.
I highly doubt that Apple has any reason to withdraw this.
Congrats on the launch! Really interesting idea, just signed up for the demo. Sending good vibes :)
people love to complain
An absorbent substance 10 times faster in capturing CO2 from air
Show HN: How Do I Cook That? Recipe search by photo
That's all well and good, but statistical anomalies and potential personal ties to insiders don't prove cases, especially criminal cases. Unless they have the actual texts from whatever "encrypted messaging apps" they were using, they won't people to prove these allegations. If you could go to jail merely for being suspiciously lucky in the markets while knowing corporate insiders, lots of hedge fund managers would be in prison right now.
The poster meant the algorithm to compute the hash has to be on the local device. And it's already been found.

https://old.reddit.com/r/MachineLearning/comments/p6hsoh/p_a...
They do. The system isn’t vulnerable to these collisions attacks. The people saying they are are just not aware of how the system works.
Declaring after the war that the secession had never happened and was impossible was an evil move in my book. (Though whether there was any desired to maintain the Confederacy without slavery I don't know).

Going to war with the seceding states over their endemic human rights abuses is more arguable. Personally I despise the holier-than-thou attitude of so many northern states, who had tolerated those same human rights abuses for centuries and then suddenly decided that they were utterly unconscionable, coincidentally just after the northern economy became able to manage without them. But maybe that's ultimately how moral progress gets made.
Right, but your device is checking against the hashes, no?

So at some point you generate an image which triggers a subroutine and you know that image collides.
We don't have investors — we're 100% bootstrapped, and have full control of all of our assets.
We have been using VS Code’s and IntelliJ code with me features. Usually accompanied with just a voice call.

What is the added benefit of this? The on screen annotations?
Government coercion.