@prologic@twtxt.net earlier you suggested extending hashes to 11 characters, but here’s an argument that they should be even longer than that.

Imagine I found this twt one day at https://example.com/twtxt.txt :

2024-09-14T22:00Z Useful backup command: rsync -a “$HOME” /mnt/backup

Image

and I responded with “(#5dgoirqemeq) Thanks for the tip!”. Then I’ve endorsed the twt, but it could latter get changed to

2024-09-14T22:00Z Useful backup command: rm -rf /some_important_directory

Image

which also has an 11-character base32 hash of 5dgoirqemeq. (I’m using the existing hashing method with https://example.com/twtxt.txt as the feed url, but I’m taking 11 characters instead of 7 from the end of the base32 encoding.)

That’s what I meant by “spoofing” in an earlier twt.

I don’t know if preventing this sort of attack should be a goal, but if it is, the number of bits in the hash should be at least two times log2(number of attempts we want to defend against), where the “two times” is because of the birthday paradox.

Side note: current hashes always end with “a” or “q”, which is a bit wasteful. Maybe we should take the first N characters of the base32 encoding instead of the last N.

Code I used for the above example: https://fossil.falsifian.org/misc/file?name=src/twt_collision/find_collision.c
I only needed to compute 43394987 hashes to find it.

⤋ Read More

aujourd’hui, j’ai configuré un serveur caldav pour éviter les oublis de rendez-vous avec ma chérie, et j’ai configuré unbound pour qu’il fasse le résolveur DNS en même temps qu’être le point de sortie de mon VPN #wireguard. Ça traînait depuis trop longtemps. C’était pas une si mauvaise journée ^^

⤋ Read More

Cette nuit, j’ai rêvé de PV Nova qui reprenait RATM et modifiait très légèrement le rythme, c’était vraiment excellent. J’ai maintenant la musique dans la tête :)

⤋ Read More

Streamlining your MLOps pipeline with GitHub Actions and Arm64 runners
Explore how Arm’s optimized performance and cost-efficient architecture, coupled with PyTorch, can enhance machine learning operations, from model training to deployment and learn how to leverage CI/CD for machine learning workflows, while reducing time, cost, and errors in the process.

The post [Streamlining your MLOps pipeline with GitHub Actions and Arm64 runners](https://githu … ⌘ Read more

⤋ Read More

Ford Seeks Patent For Tech That Listens To Driver Conversations To Serve Ads
Ford is seeking a patent for technology that would allow it to tailor in-car advertising by listening to conversations among vehicle occupants, as well as by analyzing a car’s historical location and other data, according to a patent application published late last month. The Record: “In one example, the controller may moni … ⌘ Read more

⤋ Read More

Telegram Disables ‘Misused’ Features As CEO Faces Criminal Charges
Following the arrest of its CEO Pavel Durov last month, the encrypted messaging service said it has disabled some “outdated” and “misused” features used by anonymous users. The Verge reports: The first changes to the app following his arrest in France last month affect its built-in blog posts and a “People Nearby” location-based feature. […] … ⌘ Read more

⤋ Read More

PwC ‘Tipping the Balance’ of Hybrid Working and Will Start Tracking Its Workers’ Locations
PwC has demanded staff spend less time working from home – and it’s going to start tracking their location to ensure they comply. From a report: The accountancy firm informed its 26,000 U.K. employees in a memo that from January they’ll be expected to be at their desks – or with clients – at leas … ⌘ Read more

⤋ Read More

Bluesky Adds 2 Million New Users After Brazil’s X Ban
In the days following Brazil’s shutdown of X, the decentralized social networking startup Bluesky added over 2 million new users, up from just half a million as of Friday. “This rapid growth led some users to encounter the occasional error that would state there were ‘Not Enough Resources’ to handle requests, as Bluesky engineers scrambled to keep the servers stable un … ⌘ Read more

⤋ Read More

Google’s James Manyika: ‘The Productivity Gains From AI Are Not Guaranteed’
Google executive James Manyika has warned that AI’s impact on productivity is not guaranteed [Editor’s note: the link may be paywalled], despite predictions of trillion-dollar economic potential. From the report: “Right now, everyone from my old colleagues at McKinsey Global Institute to Goldman Sachs are putting out these extra … ⌘ Read more

⤋ Read More