Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Like” at Your Own Risk

in.bgu.ac.il

Post reply on HN
Print view View original

21–30 of 35 posts

Re: “Like” at Your Own Risk

#21

Post by kerkeslager »

close04 wrote: post #16
kerkeslager wrote: post #15

There's a lot of major challenges to creating decentralized, trustless systems, but this is very easy to solve in a trustless system. All you do is indicate "Like"s by signing an object like: {post:" ",action:"like"} That way if the post changes, your signed "like" no longer applies. This trustless-ness can be introduced in centralized systems too, but the tendency in a centralized system is to trust the central auth…

This doesn't work if you're just linking to some dynamic content. People will like the link and the link itself is static but the content provided by clicking it can change without notice.

The hash is of the content, not the link.

Re: “Like” at Your Own Risk

#22

Post by close04 »

kerkeslager wrote: post #21
close04 wrote: post #16

Earlier quoted context omitted.

This doesn't work if you're just linking to some dynamic content. People will like the link and the link itself is static but the content provided by clicking it can change without notice.

The hash is of the content, not the link.

The content being a dynamic webpage where if you change a single byte (ads, page logo, anything) the hash changes? Try to load any webpage twice and see if you can get exactly the same bits.

And just imagine how much of the internet FB would have to periodically hash, and what impact it would have on those sites too.

Re: “Like” at Your Own Risk

#23

Post by buran77 »

beerandt wrote: post #13
Brave-Steak wrote: post #7

Earlier quoted context omitted.

> Another one is the ability for someone to change privacy level of a post from private to public. So that risky like that you thought was a safe one among friends could then be opened for everyone to see. This seems like a difficult problem in general and reminds me of this episode of Hidden Brain ( https://www.npr.org/2019/09/06/758281834/you-cant-hit-unsend... ). Where sharing shocking/"inappropriate" memes in a p…

Why difficult? Just put the same permissions on the "like" as the parent object being liked, and leave those permissions alone if the parent object updates.

Likes could be counted on "what" they were given to. Liking a private post would only count when the post stays private while liking a public post would be counted/displayed either way.

Re: “Like” at Your Own Risk

#24

Post by kerkeslager »

close04 wrote: post #19
heavenlyblue wrote: post #17

Earlier quoted context omitted.

You could hash both the url and the content

In this case a different ad on that page would change the hash and you’d have to hash the content periodically anyway. When I was using FB I noticed I “liked” some FB pages that in he meantime changes hands and were posting all kinds of crap. The name of the page stayed the same so I didn’t get the usual warning. With dynamic websites it’s impossible to have any control over those changes.

I think you're misunderstanding the nature of what I'm proposing.

You don't sign a hash of the URL or the page. You sign a URL of the content. If the content changes, your signed hash will no longer match, and the like no longer validates, which is exactly the point--your like isn't intended to apply to all future things the page owner could possibly put on that page, it's intended to apply only to the content that is there.

And personally, I'd never intentionally like an ad anyway. In general, ads causing things to lose all likes if they inject them into the content would be a good thing, because it would force advertisers to differentiate dynamic ads from content.

EDIT: I see you edited to clarify your other post, so my post here doesn't really apply any more. I've responded to that post directly.

Re: “Like” at Your Own Risk

#25

Post by kerkeslager »

close04 wrote: post #22
kerkeslager wrote: post #21

Earlier quoted context omitted.

The hash is of the content, not the link.

The content being a dynamic webpage where if you change a single byte (ads, page logo, anything) the hash changes? Try to load any webpage twice and see if you can get exactly the same bits. And just imagine how much of the internet FB would have to periodically hash, and what impact it would have on those sites too.

That's a feature not a bug. Not only is it a feature, it's the feature. That's the entire point.

It doesn't have to be the entire page that's hashed, only the content being liked.

Facebook would probably never implement this, because their entire business model relies on them being a trusted authority, so trustless architectures would actively undermine them.

In general, if you see my name above a post, you can assume that the only thing I want Facebook to do is sell all their assets, give the money to charity, and shut down. :)

Re: “Like” at Your Own Risk

#26

Post by hyperdimension »

soylentcola wrote: post #10

I seem to remember doing some prank-ish thing like this in the early days of Facebook. Create an activity or whatever that you "liked" (ex: camping) and friends would see that "soylentcola liked camping ". They would also like camping and then eventually you would change the name of that tag/activity/whatever to something like getting kicked in the nuts so that now it tells people that "John Smith likes getting kicke…

Yeah, I remember liking the, uh, "it in the ass" page in the early days of Facebook.

Re: “Like” at Your Own Risk

#27

Post by sebastianconcpt »

DarkWiiPlayer wrote: post #9
sebastianconcpt wrote: post #8

Scary o.O But is it the author editing the post who change it or what?

Simple example: - You upload an image of a cute cat to your webserver - You post the link to the image on some social network (using a throwaway account) - You send the link to the post to a friend, who likes the post - You switch out the image on the server for a photo of hitler (url stays the same) - You wait a day for all the caches involved to update - You act disgusted and ask your friend wtf they were thinking…

So easy. Scary indeed.

Re: “Like” at Your Own Risk

#28

Post by kerkeslager »

close04 wrote: post #16
kerkeslager wrote: post #15

There's a lot of major challenges to creating decentralized, trustless systems, but this is very easy to solve in a trustless system. All you do is indicate "Like"s by signing an object like: {post:" ",action:"like"} That way if the post changes, your signed "like" no longer applies. This trustless-ness can be introduced in centralized systems too, but the tendency in a centralized system is to trust the central auth…

This doesn't work if you're just linking to some dynamic content. People will like the link and the link itself is static but the content provided by clicking it can change without notice.

Responding to this post, since it looks like you edited it (to clarify) and I responded to my misunderstanding based on what your post previously said:

That comes down to making sure you like what you actually intend to like: you probably don't intend to like the literal bytes of the URL, you probably intend to like the content at the URL. UIs can aid in this[1] but ultimately I don't think people think that specifically, and there's not a perfect technical solution to that problem.

[1] WARNING: You're about to "Like" a URL. The content at the URL may change. Do you wish to continue? Y/N

Re: “Like” at Your Own Risk

#29

Post by Robin_Message »

DarkWiiPlayer wrote: post #9
sebastianconcpt wrote: post #8

Scary o.O But is it the author editing the post who change it or what?

Simple example: - You upload an image of a cute cat to your webserver - You post the link to the image on some social network (using a throwaway account) - You send the link to the post to a friend, who likes the post - You switch out the image on the server for a photo of hitler (url stays the same) - You wait a day for all the caches involved to update - You act disgusted and ask your friend wtf they were thinking…

- Your friend says it was a cat video that they liked and they've no idea how that happened

- Everyone shrugs, says "computers eh?" and moves on with their lives

This attack would only work for gaslighting or repeated targeting I think, and even then, I don't think it would be that convincing.

Re: “Like” at Your Own Risk

#30

Post by pixl97 »

Robin_Message wrote: post #29
DarkWiiPlayer wrote: post #9

Earlier quoted context omitted.

Simple example: - You upload an image of a cute cat to your webserver - You post the link to the image on some social network (using a throwaway account) - You send the link to the post to a friend, who likes the post - You switch out the image on the server for a photo of hitler (url stays the same) - You wait a day for all the caches involved to update - You act disgusted and ask your friend wtf they were thinking…

- Your friend says it was a cat video that they liked and they've no idea how that happened - Everyone shrugs, says "computers eh?" and moves on with their lives This attack would only work for gaslighting or repeated targeting I think, and even then, I don't think it would be that convincing.

Heh, what niece planet are you from

You forgot the step of

-take an image of the transgression and post it to Twitter

-50000 other people see you liked hitler.

-your next job sees this image on the internet, so actually no, you dont get that job.

Post reply on HN