2,717 karma · joined March 18, 2014
However, the fun part about this particular attack is that it does not require quite the same level of precision. The voltage is dropped incrementally until the CPU starts to make faulty calculations. It just so happens that AES is one of the most complex operations, and thus, the first to start faulting.
The images shown do appear to be adversarially generated inputs against some NN-based image hash or classifier, but there is no evidence to suggest that this is at all related to Apple's NeuralHash, or that the colliding hashes are from a real CSAM database (the target hashes are not public).
OP claimed they would "release 5 pieces of proof in the next 5 days" [1], and guess what, 11 days later they still haven't.
Look at OP's post and comment history, it's quite clear that they are a troll.
In the mean time, it has been actually proven that hash collisions against NeuralHash are trivially possible, see [2]
Why 2 minutes? I assume this is used as a stand-in for "very short time", because there's no way it actually takes two minutes to install unless your internet is particularly slow, and I don't imagine there's much to configure.
It seems a bit out of place, especially when the extension itself centers around the problem of 5 seconds feeling like an eternity.
Edit: I just installed it as a test, and it was ~instant.
Out of the 45 search results, the most relevant one (the UDP RFC itself) was all the way at the bottom, listed as "RFC0768" and tagged as "legacy". (I'm not sure what legacy actually means here?)
Anyway, I clicked the link, which took me to a 404 error page - https://www.rfc-editor.org/rfc/rfc0768.html (The correct URL is apparently without the leading 0)
This site does seem genuinely useful, but I think the UX could really use some polishing here, especially since I literally followed through with one of the example queries in the middle of the homepage.
I normally prefer and use dark-mode UIs, but this one is actually slightly harder for me to read.
Personally I find them paralyzing - so I'll just progress at my own speed - nobody is forcing us to use the timings proposed in the repo.
I'm not sure we do. Medium is comparatively a much bigger and more mainstream platform than HN.
While I agree it was likely lighthearted, that does not exempt it from criticism.
a) Bypassing their own code review processes.
b) Creating a contributors list, just so they can put Carmack at the top of it (what about all the other contributors?!)
IMHO this crosses a line. Not in a big way, but one worthy of comment.
That may be the current reality of the situation, but it doesn't mean we have to keep it that way.
I'm not saying he doesn't deserve his status, I'm just saying let's not get too fanatical about it.
I realize that your comment was likely made in jest, but it still bugs me.
What's your plan once you reach the 4-character limit? Roll over to 5, or something fancier?
I think the best way to improve things is via increased transparency - If I can read a reviewer's past reviews, I can make a better-informed judgement of their reviewing integrity.
To maximize your advertising revenue, you need to track your users as effectively as possible. This:
a) Reduces user privacy. Even recent developments like FLoC, which appear to be pro-privacy on the surface, are really just yet another datapoint with which to violate the privacy of users.
b) Reduces performance. It's easy to blame trendy bloated tech stacks for the state of the web, but the reality is that a big chunk of the slowness comes from ad-related tracking and delivery technologies (install privacy extensions on a low-end system and see the difference!). This reduced performance disproportionately affects those with lower system and network resources, further reinforcing global inequality.
Although some will disagree, I do think that it's possible to advertise ethically, but no large corporation operating in a capitalist society is going to be doing that voluntarily - unless strict regulation comes down from above (Spoiler Alert: It won't).
All that said, I don't blame the author for working in adtech, but perhaps only due to my rather bleak perspective that we're all just cogs in the capitalist machine whether we like it or not.
Don't hate the player, hate the game.
P.S: Cynically, I think the author's announcement of their charitable donations counts against them. It makes it seem like he's trying to "offset" the harm caused by his work, even if he won't openly admit that such harm exists. Charitable donations may make you a net-virtuous individual, but they do nothing to address the harm of adtech itself - which is orthogonal to the author's original claim that they believe that advertising is a good thing.
This is extremely non-simple. It is a strictly harder problem than just... encoding image+text in a sane container format like HTML or SVG.
The advantage of PGP is that it can be verified entirely out-of-band, and distributed widely.