Tim Bray

Web geek and environmentalist with a camera at the bottom left corner of Canada. He/him.

These posts are coming from a member-owned cooperative: https://cosocial.info

My posts are searchable and licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License, see https://creativecommons.org/licenses/by-nd/4.0/

Location: Vancouver 🍁
Blog: https://www.tbray.org/ongoing/
Threads: https://www.threads.net/@twbray
GitHub: https://github.com/timbray

Public Key

npub19ua0a9gu7ggm693nqm6knq3zutckcfde9p6ra7a8fu73xhvy3sgqz253cv

NIP-05 Address

timbray_at_cosocial.ca@momostr.pink

Profile Code

nprofile1qqsz7wh7j5w0yydazcesdatfsg3w9utvykujsap7lwn570gntkzgcyqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsrqpcda

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub19ua0a9gu7ggm693nqm6knq3zutckcfde9p6ra7a8fu73xhvy3sgqz253cv

Show more details

Last Notes

2024-08-28 20:56:27

- reply

Not me. NDP has waved through every freaking fossil-fuel project, entirely failed to protect old growth, Furstenau is cool. Greens got my vote. NDP will do OK, Rustad is a soft target .

2024-08-18 00:59:45

Hey, it’s #BLackCatAppreciation Day! We certainly appreciate ours.
https://media.cosocial.ca/media_attachments/files/112/980/314/292/900/216/original/497119150bf51ae7.jpg

2024-08-12 02:11:09

- reply

> in a democracy they can continue to heckle but they've made their point.
I disagree. Moving America's Overton Window on IsraPal will require persistent retail politics, which is to say embarrassing public shouting until there’s evidence that their concerns are getting attention (there isn’t yet). Probably they won’t change any policies pre-election, but they need to make it clear they’ll be an ongoing presence that’s hard to silence.
@npub1u97…c75y

2024-08-09 16:54:09

- reply

2/2 I also agree that the handling of the was amateurish, that amateurs will never notice the multiple versions, and that the timestamp isn't useful.
BUT: All I am claiming is that first statement. This picture was blessed by the CBC and signed with their key, and so if I trust the CBC, it's reasonable to trust the picture. Yes, it would be better if they provided a correctly signed provenance chain. But 1 level of provenance is still useful.

2024-08-09 16:50:50

- reply

1/2 Quoting:
> The C2PA signature was issued by "CBC/Radio-Canada". If you already trust CBC, then there's no reason to doubt their signature. And if you don't trust CBC, then their "valid" signature doesn't add any additional confidence.
I agree with this. And this is all I am claiming. If I trust CBC, and I see CBC signed this, I am inclined to believe that they believe the picture shows what they say it shows.

2024-08-08 18:52:09

- reply

Your criticisms of C2PA seem good to me. But its practical applications that I've heard of are in establishing verifiable provenance, and C2PA works fine for that narrow but very useful purpose. You're damaging your credibility by holding onto your useless-for-all-purposes line.

2024-08-08 18:48:37

- reply

Huh? In my Nadia scenario I'm explicitly using C2PA to validate that incoming media are signed appropriately.

2024-08-08 14:39:17

- reply

Also, dropping by trending posts and hashtags is useful

2024-08-08 14:38:36

- reply

Hmm I just follow interesting people. Hashtag search is useful. Best single follow is @npub1fqg…7yvt

2024-08-08 02:22:16

- reply

Who controls CNN in 2037?

2024-08-08 02:01:48

- reply

Cool write-up, thanks. Newsblur gets a passing grade.

2024-08-08 01:57:37

- reply

2/2 Your first exploit is pure social engineering, has nothing to do with C2PA. Just like https://xkcd.com/538/
In the 2nd, Malory can take an existing signed photo of Nadia and produce a dupe with a different date. So what? Given an existing trust relationship they’d investigate and discover the dupe/date story and be puzzled, that’s all.
C2PA works fine for provenance support. That matters.

2024-08-08 01:55:46

- reply

1/ First of all, I’m mostly in agreement with you. The date-signing hole is a horrible botch, and C2PA is unnecessarily complicated, and makes grandiose claims that it can’t support. But I still believe that for simple provenance/trust applications, it works fine, and…

2024-08-08 01:02:10

- reply

All these years later and Feedly's “back” button is still dysfunctional.

2024-08-08 01:01:19

- reply

I hear it's good, but I need it to sync across mobile/tablet/browser, does it do that?

2024-08-08 01:00:14

- reply

yeah sadly they too seem to be doing an AI thing but it's not in your face.

2024-08-08 00:09:48

- reply

Android app seems fine.

2024-08-07 23:46:15

Have just migrated from Feedly to Newsblur. Minor application annoyances with Feedly and it seems to want to become an Enterprise Solution; I just want a feed reader. A bit of startup friction but now liking the experience. Recommended.
The feed ecosystem remains about the purest, lowest-friction Web experience imaginable.

2024-08-07 16:46:06

In the changing room at the Western-Wear store. Western-wear shirts are objectively better than others because they (a) come in more colors (b) make strong design statements and (c) have snaps which are objectively better than buttons but I’m not going to recurse and (d) mostly 100% cotton.
https://media.cosocial.ca/media_attachments/files/112/921/750/072/747/210/original/3f2b727a2090c657.jpg

2024-08-07 16:15:51

- reply

Having read (I think) the essentials of your work, I still think simple provenance scenarios work.
1. Nadia works for BigPub, which wants to use C2PA
2. BigPub tells Tania "take a selfie this morning on your C2PA-equipped camera and send it to us"
3. Nadia does so. Now BigPub knows Nadia's public key.
4. In future, when a pic comes in from Nadia, they check the C2PA against the remembered public key.
All this establishes is provenance, but I think it works fine?

2024-08-07 14:41:18

What the Mastodon team is up to: https://www.patreon.com/posts/big-first-half-109607953?utm_campaign=patron_engagement&utm_source=post_link&post_id=109607953&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyZWRpc19rZXkiOiJpYTI6MDI0MGRkM2ItOTQ2ZS00NDhkLWI3ZWQtYjRiODFlYmMyMTM0IiwicG9zdF9pZCI6MTA5NjA3OTUzLCJwYXRyb25faWQiOjkyNTE2MzEyfQ.S1ryPSfiTbLsi-j6o5p5O-RRyQ1VGv7j9k8IxS2BDA0&utm_id=2752114a-1ca5-4731-bd0d-ca0392d5205e&utm_medium=email
[you might have to be a donor to see this, so make a donation already.]

2024-08-06 22:21:37

Wow, Google kills ChromeCast, replacing it with “Google TV” devices:
https://www.theverge.com/2024/8/6/24214471/google-chromecast-line-discontinued
https://www.theverge.com/2024/8/6/24214055/google-tv-streamer-features-price-matter-thread

2024-08-06 20:19:18

- reply

Definitely true, especially for pale white people. Some browner people manage to look good under the lights without chemical help.

2024-08-06 17:14:02

- reply

That did it! LazyWeb is the best.

2024-08-06 17:07:10

- reply

I turned off "Sound check" but didn't notice any effect.

2024-08-06 16:49:25

Dear LazyWeb: On my fairly-recent M2 MBP, the music apps (Apple Music, YouTube Music) won’t play loud. Searching suggests that back in Intel days, this was a thing and you had to reset NVRAM, but “this is not a problem on Apple Silicon”. Well, yes it is. Browser videos play at appropriate volume. Anyone else seen this?

2024-08-06 16:11:52

Am in Saskatchewan.
https://media.cosocial.ca/media_attachments/files/112/915/953/187/840/986/original/66081963d02b2035.jpg

2024-08-06 05:59:32

Most of my favorite reading is from people who were having lots of fun while writing. Zoe Williams had a *lot* of fun with this one: https://www.theguardian.com/books/article/2024/aug/06/my-weeks-of-reading-hornily-steamy-book-sales-have-doubled-and-i-soon-found-out-why

2024-08-05 16:56:37

- reply

I.e. “send me a C2PA-signed picture and then I’ll have your public key, which I can reliably associate with an email address or social-media account or whatever.” If you have a specific attack against either of those scenarios, I’d love to see it.

2024-08-05 16:56:23

- reply

One thing you say that I agree with: It’s all about trust. And for that, it seems to me that all you need is an ordinary keypair. If you look at the scenarios in my piece, at https://www.tbray.org/ongoing/When/202x/2023/10/28/C2PA-Workflows#p-18 and https://www.tbray.org/ongoing/When/202x/2023/10/28/C2PA-Workflows#p-19, I think they work with C2PA as it is? Specifically…

2024-08-05 16:55:53

- reply

Well, I haven't had time yet to work through your walls of text, but I appreciate your work and will dig through that stuff, and will do a follow-up blog if my opinions change significantly. I learned one thing for sure, about the broken-ness of the timestamp signature stuff. That's horrible. But…

2024-08-05 16:33:04

- reply

oh right, bad at counting digits.

2024-08-05 14:24:23

- reply

Are those cm specs directly comparable to the mm we think in today? i.e. 5cm = 500mm? And 13.5cm, well, wow.

2024-08-05 06:16:09

- reply

Nice thing about following this war is you get to look at words and pictures about obscure corners of Central Europe and Southeast Asia. For example, in Elista, “The town center has a number of renovated public parks focused on the main square, boasting statues to both Lenin and the Buddha.” I guess they lack only Taylor Swift…

2024-08-05 05:19:36

- reply

So if you edit a C2PA-signed image with C2PA-equipped Photoshop and really defaced or replaced the image, the provenance chain camera=>photoshop=>you would still be there. C2PA doesn't usefully tell you much about what was done, just who did it. So it comes down to whether or not you trust the photoshop operator. All C2PA does is establish who that was.

2024-08-05 05:15:29

- reply

I forget the details (this is from 1998!), but because you have to use the xmlns prefix to declare a namespace/prefix binding, I think the syntax breaks if it's trying to do it for itself.

2024-08-05 02:29:43

- reply

Definitely, the phones already have powerful CPUs and embedded keys. I assume that a future release of the camera app will have it built-in

2024-08-04 23:58:05

- reply

I disagree: https://www.tbray.org/ongoing/When/202x/2023/10/28/C2PA-Workflows

2024-08-04 23:13:37

- reply

Tl;dr: give up on the arms race trying to detect fake images, and start using C2PA to show which images are provably non-fake.

2024-08-04 23:11:17

Social Media Platforms Are Trying to Prove Fake Images the Wrong Way | PetaPixel https://petapixel.com/2024/08/04/social-media-platforms-are-trying-to-prove-fake-images-the-wrong-way/

2024-08-04 05:00:25

- reply

Way past French I think. Have heard it in non-English languages on multiple continents.

2024-08-04 02:11:47

- reply

If a little is good, more must be better…

2024-08-03 03:07:27

- reply

Oh, you're entirely right, will fix.

2024-08-03 02:51:23

- reply

Have no experience with that kind of defederation (Ewwww) so will shut up.

2024-08-03 02:17:35

- reply

A slimy can be a furry too.

2024-08-03 02:13:29

- reply

(but don't wanna see your ankle)

2024-08-03 02:11:07

- reply

Possibly one “ouch that sucks, heal fast, can I bring you lunch” is outbalances N leechers, where N>1?
BTW, ouch that sucks, heal fast, if you're in Vancouver can I bring you lunch?

2024-08-03 02:04:49

- reply

> when it comes to *being* defederated, it isn't the end of the world.
I think it kinda is for Nazis? Because they don't want to talk to each other, they want to throw bigoted slime. I think defederation is the best response to abuse in many/most cases.

2024-08-02 22:40:18

- reply

When I was a kid I saw Tourischeva and Korbut on an early tour before they were famous, in Lebanon. Nobody had ever seen a no-hands front walkover on the beam before and when Tourischeva did it the audience fell into shocked silence.

2024-08-02 22:35:43

D’oh, the climate catastrophe is bad for business, not just people: https://www.bloomberg.com/opinion/articles/2024-08-02/a-1-trillion-time-bomb-is-ticking-in-the-housing-market

2024-08-02 22:02:12

Thoughts on Mastodon trust-&-safety software plans from one of the Mastodon team, from this time last year: https://renchap.com/blog/post/evolving_mastodon_trust_and_safety/

2024-08-02 16:46:26

- reply

Well, we have per user blocklists now, you can block any account or instance (or hashtag I think?). I guess what's missing is published shared blocklists like the ones that instance moderators use (including #CoSocial )

2024-08-02 16:25:00

In which I survey the current #Mastodon/#Fediverse tumult about our #BlackMastodon citizens experiencing hideous outbursts of #racism and abuse generally, and offer one or two ideas on improving safety: https://www.tbray.org/ongoing/When/202x/2024/07/30/Invisible-Attackers: https://www.tbray.org/ongoing/When/202x/2024/07/30/Invisible-Attackers
(BTW I strongly recommend following #BlackMastodon)

2024-08-02 03:54:32

- reply

You should assume that everything you publish is available to anyone, forever.

2024-08-02 02:01:08

- reply

Thailand is 404.

2024-08-01 22:00:14

- reply

(Not defending CS)

2024-08-01 21:59:54

- reply

For the record, at least one person disagrees strongly. Being in a group with a good CD pipeline really improves the engineering experience. Not clear to me that it cuts costs either.

2024-08-01 18:05:12

For #Vancouver people: Molly Tuttle, one of the finest artists on the Americana/post-bluegrass scene, is playing the Hollywood Theatre tonight. I just discovered this yesterday and was able to grab a ticket. She plays a hell of. a show, highly recommended.
https://www.hollywoodtheatre.ca/events/molly-golden-highway

2024-08-01 15:51:26

This is great!
https://tech.lgbt/@alex/112123494612503950

2024-08-01 15:18:37

- reply

Mmmm I'm gonna say that in 2037 your basic consumer camera, plus AI-driven postprocessing, will be able to manage high quality pictures in very dark situations.

2024-08-01 03:02:39

For all of us disgusted by the NYTimes (no, I haven’t canceled yet), the last few days have been illuminating. The Kamala-surge-GOP/Trump-implosion story is regularly top/center on the front page (just now it’s the Black-journalists fiasco). Occurs to me that maybe the Times isn’t institutionally anti-Democrat, it’s just institutionally lazy, focuses obsessively on whichever story is easiest to tell?

2024-07-31 16:54:13

- reply

On that specific point, I gather the hyperscalers are backing off their carbon-neutrality goals specifically because of the need to support the LLM workloads. *sigh*

2024-07-31 16:40:23

- reply

>> As much as I care about global warming I don't think "stop using energy for technological advancement" is a credible position.
Call me a fanatic, but I’m very negative about embracing new shinies that hasten the devastation my children's generation will have to live with.
But, "Make it impossible to ignore the cost of technological advancement" is a credible position. A good first step would be an aggressive carbon tax.

2024-07-31 14:41:36

- reply

Well, and we can't even manage to stop Bitcoin.

2024-07-31 14:35:17

- reply

Interesting. Registering a conventional nonprofit in Canada (at least in the province of BC where I am) costs a couple of hundred dollars, requires no lawyers, and is entirely online. A co-op is a slightly heavier lift but really no biggie.

2024-07-31 14:29:58

- reply

I think that it's cleaner and more accurate to think of it as a union while implementing it. Having said that, from the user POV, yes.

2024-07-31 14:27:34

- reply

I suspect AI as it is now is neither financially nor environmentally sustainable. Looking for counter-examples to see if I'm wrong.

2024-07-31 14:14:10

- reply

How much do you think it would be reasonable to charge for this service? Should it be ad-supported?

2024-07-31 04:57:04

- reply

hmf I just downloaded a Linux on my Pixel.

2024-07-31 04:46:14

- reply

Good point. My actual favorite is Beshear.

2024-07-31 03:27:59

- reply

Setting up an instance is way less work than incorporating a co-op, adopting by-laws, getting a bank relationship going, etc etc

2024-07-31 03:25:50

- reply

Size TBD. Membership is limited to residents of Canada.

2024-07-31 02:01:20

Hoping #KamalaHarris picks Shapiro, because running against two people who embody Blacks, Asians, and Jews is going to create potentially-lethal explosive pressure in the heads of countless MAGA bigots.

2024-07-31 01:57:51

- reply

(Which is a long-winded way of agreeing with Marco)

2024-07-31 01:56:27

- reply

I think the two most interesting Fediverse problems are, by far, (1) moderation and (2) financial/organizational sustainability. The tech is boring. Fortunately the tech is also acceptably cheap to operate - my thumbnail estimates are less than $2 / user / month. But there’s loads of unexplored territory in organization design.

2024-07-30 22:38:39

- reply

Wisdom.

2024-07-30 20:08:07

(The whole thread is amusing): https://digipres.club/@foone/112877144366434194

2024-07-30 19:59:04

- reply

No subdomains, you pick your handle and you get a @cosocial.ca handle like mine. Like I said, it's boring. We have an elected board and a policy that any serious decisions get taken to the membership to seek consensus. Note: We're still small, <200 members.

2024-07-30 19:54:18

- reply

You're entirely within your rights to disagree with the dev team on priorities. But I believe very strongly, based on what I see, that they are *not* in it for the money. Also, no sane VC would ever invest in Mastodon, which is one of the things that I like about it.

2024-07-30 19:48:04

- reply

Our tech stack is 100% boring/vanilla. Our co-op structure is off-the-shelf boring, taking mostly just the defaults for our legal jurisdiction. The only thing that’s innovative is the combo: co-op owned instance. Observation: Requiring membership approval and a $50 payment is *amazingly* effective at discouraging griefers.

2024-07-30 19:41:43

- reply

Would attend.

2024-07-30 18:59:56

- reply

There are two that I know of. https://CoSocial.ca (see https://blog.cosocial.ca) and https://social.coop/about

2024-07-30 18:36:44

- reply

Also, on purely engineering grounds, I don’t think pursuing a big boil-the-ocean project is the way to go, if only because our adversaries are pretty agile. I would like to see an iterative approach, repeatedly patching flaws in the system.

2024-07-30 18:35:19

- reply

I somewhat disagree. I think there are counter-measures that, while they wouldn’t make racism vanish (we're embedded in a racist society) would move the needle in a useful direction. and wouldn’t require years of effort. You are 100% right that the dev team needs more resources. I think it’s fair - necessary, even - to yell at them to prioritize these moderation issues, but I suspect accusing them of racism is unproductive.

2024-07-30 18:29:54

- reply

FWIW your posts in recent days have raised a few peoples' consciousness, including mine. Among other things, Masto has an “invisible attacker” problem, i.e. nobody else can see the abuse that gets pushed into your face. While the people saying “it’s easy to fix, just fix it” are wrong - it’s a hard problem - that doesn’t mean it shouldn’t be a priority. Thanks for raising your voice.

2024-07-30 14:47:34

- reply

Might "I write the code and the LLM writes the unit tests" be a viable strategy?

2024-07-30 06:23:30

- reply

Had never heard of it. Will look.

2024-07-29 23:24:44

- reply

I believe that (pathetically small) group is now talking to @npub1ay2…exel about what needs to be done.

2024-07-29 23:21:15

Dragon garden.
#photography
https://media.cosocial.ca/media_attachments/files/112/872/343/041/357/271/original/9e524835ff280888.jpg

2024-07-29 23:01:34

- reply

Yeah, and Quamina's FA traversal can hit the same X match more than once for the same input, so in fact we run the match list through a map[X]bool to make callers' lives easier.

2024-07-29 22:01:15

- reply

Well, common prefixes work fine, so if you are merging "car" and "cat" there'll be 2 states to match "c" and "a" and then transitions to different states on "r" and "t". If you have "foo" and "foobar", three common states, the last of which signals that you matched "foo", but it's not terminal in that there are 3 more states to match "foobar". On the other hand, if you have "dancer" and "chancy" it definitely won't notice the common "anc".

2024-07-29 21:24:48

- reply

Ewwww Dreher. Who is she?

2024-07-29 20:25:57

In which I write 4000+ words on implementing a simple piece of set arithmetic: “Union of Finite Automata”: https://www.tbray.org/ongoing/When/202x/2024/07/28/Union-of-Finite-Automata
A majority of you will read that title and correctly conclude that this isn’t for you. I mean, it has no math aside from a few subscripts, and no circles-and-arrows either, but still.

2024-07-29 19:56:14

- reply

And yet you personally, if I'm parsing your narrative correctly, have been getting good results all along, nearly as soon as you started using this stuff. So… it’s particularly well-suited to the kind of software work you do? Or am I missing something?

2024-07-29 18:00:48

Monday not working out that well? Relax for 12 minutes of visual poetry: “The Extraordinary Salish Sea”: https://www.youtube.com/watch?v=oneCVfKdI9I

2024-07-29 15:08:01

Websites are Blocking the Wrong AI Scrapers https://www.404media.co/email/87e0e07a-7d24-4788-b417-1821b40c8c1d/

2024-07-29 02:27:53

If your alt text looks #AI-generated I am not boosting you.

2024-07-28 23:36:10

- reply

Well, if Xi launched a surprise invasion of Taiwan next week, my general sense is that most of China’s youth would eagerly rally around, the CCP has already been very successful at cultivating revanchist nationalism in the younger demographics. Not just attacking but overcoming the US would play very well. Total-war confrontation with India, with so many millions of deaths, is definitely new territory though.

2024-07-28 06:15:41

- reply

Will take all the meaning I can get thks.

2024-07-28 02:32:32

- reply

Wow, China can pump out another ~5m soldiers? Surprising.