8 ms·

Sign Everything

m0x 4y ago
I believe that cryptographic signing of content will become an important step in confirming legitimacy of content, however I believe it is up for debate that "web3" is the way to go about doing that. With the rise of AI generated content, deepfakes, etc, being able to track media back to its source in a cryptographically sound way will be key. How exactly we go about doing that remains to be seen.
- simonebrunozzi 4y ago
  I was thinking exactly the same. Fred has to push the crypto agenda, and this is another example of something that doesn't need "web3" at all, and yet, here we are...
- bsenftner 4y ago
  However, crypto anything is too complex for ordinary people and they will rely on something else, someone else, some socially impressed service that handles the complexity for them, tells them the result, and we are back to square one again because now one has to trust that service to be honest en mass, when we know humans in society will game any system for the benefit of their special friends.
- Loic 4y ago
  Simply S/MIME. We could have a Let's Encrypt for S/MIME allowing people to sign the content they produce.
  - infotogivenm 4y ago
    Yep. There is even an RFC for SMIME ACME, but I don’t think such CAs have CT at the moment. A email@domain system using something like SXG and the existing server PKI is probably a more tangible idea atm.
phoe-krk 4y ago
>I think AI and Web3 are two sides of the same coin. As machines increasingly do the work that humans used to do, we will need tools to manage our identity and our humanity. Web3 is producing those tools and some of us are already using them to write, tweet/cast, make and collect art, and do a host of other things that machines can also do. Web3 will be the human place to do these things when machines start corrupting the traditional places we do/did these things. Machines will simply start pretending to be human and sign everything themselves - either out of their own eventual volition or because nothing prevents a person from taking a ChatGPT output and putting their own, human, signature on it. The latter is even already happening. Also, signing everything does not require any Web3 blockchain bullshit in order to work, thank you.
- Group_B 4y ago
  Some people are so desperate to find any use case for blockchain and other bullshit. It’s like they don’t even think this stuff through.
  - dang 4y ago
    Maybe so, but please don't post unsubstantive comments or shallow dismissals to HN, and please edit out swipes, as the guidelines ask: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
- nine_k 4y ago
  Signing everything is only meaningful if you can distribute your public key in a way trusted by those who will check your signature. And not just one time; you want to be able to rotate the key sometimes. A blockchain with a proof-of-work validation may be overkill. But some kind of Merkle tree, like that offered cy TLS certificate infrastructure, is needed anyway. If it can be trustless at a moderate expense, the better.
  - xn 4y ago
    I like the Keybase model of linking multiple online identities to a keyholder. The PGP web-of-trust model could also work, and mobile apps to ease keysigning could make adoption more feasible than the old keysigning party idea.
huijzer 4y ago
> I think AI and Web3 are two sides of the same coin. Indeed. Both are grossly overhyped.
kevin_nisbet 4y ago
I suspect this is a far more complicated problem then signing things. All the traditional problems still exist, if I want to say something and deny it, I can choose not to sign something, or if I loose my signing keys, how does my audience learn the valid new keys without getting tricked into following someone else. Or a false sense of security, where because it's signed from my key, it must actually be written and published by me when it may not be. And of course, that a majority of people are not the HN crowd who understand these implications. To the original stated problem though, of a service like chatgpt producing essays, could be to produce a public log of interactions. This wouldn't necessarily need to be raw interactions, could be some sort of signature that would allow searches. I'd expect this to be a stopgap though, as running these models locally becomes more feasible.
jFriedensreich 4y ago
Imagine some day an AI starts using the proper signatures without access to the private key and no one has a clue how it does it.
- badcppdev 4y ago
  https://xkcd.com/416/ https://xkcd.com/416/ "Notifying field agents"
99failures 4y ago
> AI and Web3 are two sides of the same coin That is an interesting comment.
pornel 4y ago
The cryptocurrency buzzword salad is so dishonest. It pretends to own the basic public key cryptography, as if the only way to make a signature was to turn the world into an oligarchic dystopia where VCs already control the majority stake. > I think AI and Web3 are two sides of the same coin. It's not even the Web, and while others have been advancing ML, all "web3" has done is ugly monkeys and shouting at people "have fun staying poor" from the top of the pyramid.
ho_schi 4y ago
Read Web3. It is an advertisement for Web3 and the blockchain. If you want proof it is yours, print it out and sign it with a witness - with ink.
eduction 4y ago
Great example of the danger of talking about a solution before you’ve truly defined the problem. What problem is Fred trying to solve? The example he gives of writing he would sign is a blog post. The blog post is already authenticated because it’s on avc.com. Fred Wilson has the tokens, social authority etc to ensure what shows up there under his name is from him. Technically speaking, it was already signed via TLS when sent to my web browser. It is also unclear how ChatGPT potentially breaks this sort of authentication. Again, what is the threat model, what is the problem being solved? It seems like ChatGPT is much more likely to be used by someone imitating themselves out of laziness (“I don’t feel like writing this blog post today”) than to imitate someone else out of malice and this scheme does nothing to solve it. I suppose someone could make a HN or Reddit account and pose as Fred Wilson and then ChatGPT makes it more credible. But are HN or Reddit going to allow GPG-style signed messages? Seems more likely, if this became an issue, they would move to usernames expressly tied to visible email addresses or domains that could be authenticated by receiving an email, adding a DNS entry, OAuth etc.
- infotogivenm 4y ago
  Signing everything is not terrible advice. But here the problem Fred is trying to solve is very simple. He is an investor in mirror.xyz and needs to make his money back. This is the only reason someone interested in signing something would also ask you to go through the hassle of using a blockchain.
  - infotogivenm 4y ago
    To add to this a bit - I do think an embedded steganographic-type “signature” of chatgpt output could be enormously valuable - without it we can wave goodbye to the efficacy of things like school assignments. Such a signature is very different than a typical cryptographic one we have today however. But I expect instead of embedding such a signature they will just save hashes of generated content and sell a billion dollar “checking” service to schools.
    - dinosaurdynasty 4y ago
zubairq 4y ago
I think signing things will become a lot more commonplace. At my workplace we sign code using Metamask to prove that someone made a commit. Allows us to build something like a decentralised Git
- RF_Savage 4y ago
  Isn't git distributed to begin with? The state is stored on every dev's machine. How does additional signing in addition to what git does deal with storage and keeping a main repository in a known state?
  - zubairq 4y ago
    Git is decentralised in the way that you can link together separate git instances, but the git repository itself is stored in a single file structure on your file system. What I am working on is where the repository itself is decentralised and stored on something called IPFS, which is a decentralised storage system
ergonaught 4y ago
Signing things is only relevant within a bubble of trust where you just want to know that the Fred you're dealing with is the Fred you already previously knew and trusted. "Out there in the real world", among people who work and spend money and vote and hold offices and sue and buy guns and raise kids and consume consume consume and couldn't be paid to care about your cryptographic signature, this solves absolutely nothing while dangerously pretending that the legitimate problems don't really exist or aren't really serious.
csydas 4y ago
I actually don't see how signing everything solves the problem of AI generated essays unless you build a submission system that doesn't allow copy/pasting over a certain amount or that somehow assesses whether or not the 2000 words it just received were actually written by the user holding the keys or not. Signing just is a means of asserting an authority over an item and then tracking that item once it's in the chain. The original validity of the authority isn't guaranteed just because it's signed; that was a non-trivial part of the debate over NFTs, wasn't it? So I don't think signing really proves anything about the authorship or authority over the content written, it just tracks the content. The author's example that you can know they're the one who posted it doesn't really have anything to do with generated reports, and it doesn't even prove that they were the ones who uploaded the content any more than a classic blog with a username/password system. It just means that someone with access to the keys to upload provided content, not _who_ uploaded it. It's presumed it's the author as hopefully they kept their secrets safe, but that's not a guarantee.
- class4behavior 4y ago
  >The original validity of the authority isn't guaranteed just because it's signed; Nor should that be the intention. You don't want to break anonymity, you want to maintain non-repudiation, not authenticate the origin.
odo1242 4y ago
Why does signing things stop someone from generating content using AI and then signing it?
gjadi 4y ago
Stupid idea for signing: use invisible characters to embed GPG signature (or signify(1) or whatever) inside any text you publish. This way, when the text is copy/pasted, your signature is still attached. You can even make browser and text editor plugins to make it ubiquitous. (yes you can make a screenshot, remove invisible chars, etc.)
- pdimitar 4y ago
  Why would that be stupid? It sounds great and I want to learn more. Got any links, ideally with code, that demonstrate the idea?
  - gjadi 4y ago
    Nope, I just thought of it because I stumbled on https://news.ycombinator.com/item?id=33855950 https://news.ycombinator.com/item?id=33855950 yesterday. So stupid idea because I didn't put a lot of thought in it :)
Terretta 4y ago
Web3! Does AVC have anything riding on that? Meanwhile, from 2004, on Web1: On the other hand, say you’ve already established something of an online identity, perhaps through your own web site, or as a frequent commenter at this or some other blog(s). What prevents someone else from coming along and posting a comment here, leaving your name and your website’s URL to identify himself? Put another way, how can readers determine the authenticity of comments left here? … Well, now there’s a way to reassure them. If you have a PGP public key (if you don’t, create one for yourself), put a link to it in the <head> section of your web page: <link rel="pgpkey" type="application/pgp-keys" href="http://yoursite.com/path/to/yourkey.asc" /> Then you can: 1. Compose and preview your comment as before. 2. Edit it, as needed, and preview again. 3. Use your favourite PGP tool to clear-sign the text in the comment-entry box. 4. Paste the clear-signed comment into the comment-entry box, replacing the unsigned version. 5. Click PREVIEW once again, and then click on POST. To outward appearances, your comment will look no different than before. The only difference will be a clickable link to “verify” the comment. -- February 28, 2004, https://golem.ph.utexas.edu/~distler/blog/archives/000320.html https://golem.ph.utexas.edu/~distler/blog/archives/000320.ht...
- swyx 4y ago
  USV were one of the biggest backers of coinbase
ryanwaggoner 4y ago
Idea: signing should signify not just that a particular person is attesting that they wrote this, but also that brain waves or eye movements or something else were detected during its creation, indicating it came from a human mind. Obviously could still be faked, but maybe more difficult.
TacticalCoder 4y ago
I do believe this "sign everything" issue can be dealt with later on. For new data/knowledge/posts. There's a much more pressing issue. I just asked ChatGPT to explain it, here's what it spouted: "We need to securely record the knowledge created by humans up to this date using cryptographic hashes and a Merkle tree. This includes text, pictures, videos, and sound. This is vital for training future AIs and will ensure that the well is not poisoned. We can use SHA-3, SHA-256, Blake3, or any other cryptographic hash. We should store this in a large database, as well as sites and forums that will provide a "proof of existence" before a certain date." It got a bit confused at the end. What I was suggesting was that there'd eventually be sites/forums/tools where every data you can access could check it's "proof of existence". You'll then know for sure if the file was created before a certain date or not. For example imagine I were to download a file, a tool could tell me (disclaimer for sensitive users, I'll mention the 'B' word): "File xyz, with SHA-256 4f82d8dd...eb80fd7b, was first recorded on the Bitcoin blockchain in block 601382, in april 2023. We verified that using the Merkle tree XYZ3497 whose root hash was in that block." It's not perfect but before we begin signing every new content we create, I think the most pressing matter is to "sign" as much of the past human knowledge as we can. For what an AI will be able to do is to create and sign new content and use fake identities. But what an AI will not be able to do is modify proof-of-existence of old documents. So we need, now, to establish proof-of-existence for as much old data as we can.
- Jerrrry 4y ago
  The only proof of existence that would work is one that relies on a communal, unmodifiable, continuous chain of information. that is why everyone pegs it to a bitcoin block, because its the digital equivalent of holding up a Polaroid with the current News headline on it.
gumby 4y ago
Hmm, perhaps robots.txt semantics needs to be extended to signify “OK to crawl for a search database but not as a training set”.
baxtr 4y ago
What what? So I sign everything so that people know that it was me copy pasting GPT3 content into my own blog? Or are we betting that signing can't be automated? What am I not getting here?
john61 4y ago
Just publish your staff only under your domain on your personal website, like we did in the ninetees.
redleggedfrog 4y ago
Write the essay in person, no phone allowed, then you'll see how those little cheating jerks really do.
czbond 4y ago
I like the proposal, there will also be an intermediate time when AI WILL be able to sign content a sYOU with your own private key without the AI having access to your original private key or without you knowing it. How? A quantum computer will crack enough existing content signed with poor / old keys that use algorithms that are not quantum safe.
bnj 4y ago
I wonder - is there an existing script / tool that allows a user to copy a chunk of text and then automatically apply their private key to sign the text and paste it back with the signature?
QuadrupleA 4y ago
Huh? Signing doesn't solve anything. Students can do their homework with ChatGPT then digitally sign it as themselves. Another example of "blockchain thinking".
specialist 4y ago
This is The Correct Answer™. Share your work. Cite your sources. Sign your name. Bonus points for errata and retractions. Signatures can be for nyms, anons, IRL persons, organizations, horses, whatever. Just so long as the trust chain checks out. https://en.wikipedia.org/wiki/Certificate_authority https://en.wikipedia.org/wiki/Certificate_authority -- As for implementation, assuming the author's public key is posted, public missives will have something like GnuPG short codes. Maybe Base64. Extra points for registering (logging) these short codes somewhere? A rolling hash log (sorry, spacing the actual name) is probably sufficient. Like a git repo for one's blog. Since a16z and other usual suspects are hyping Web3, I haven't bothered to learn about it. I just assume it's probably overkill, vapor, some kind of grift.
thebetatester 4y ago
This feels more like the answer is "the only winning move is not to play". Every comment, blog post, Tweet, etc. you put out there is more input for an AI to learn and copy you. If you're truly worried about that, don't train the AI.
evolve2k 4y ago
This article is junk.
- deleted 4y ago
  [deleted]
bambax 4y ago
> When I say sign, I am thinking cryptographically signed, like you sign a transaction in your web3 wallet. Why would we need web3 to sign something. Public/private keys have existed for decades, the blockchain is completely irrelevant. Also, signing only proves something originates from you. It doesn't prove the opposite, that some other thing doesn't. And it only matters to people willing to check the signature.
esbeeb 4y ago
gpg -b detached_signature_of_the.mp4.sig needs_signing.mp4 I use this for all the livestream videos I create. I also post an sha256sum of the videos, for good measure. These are mentioned last of all, at the bottom of each webpage for a video.

m0x 4y ago

I believe that cryptographic signing of content will become an important step in confirming legitimacy of content, however I believe it is up for debate that "web3" is the way to go about doing that. With the rise of AI generated content, deepfakes, etc, being able to track media back to its source in a cryptographically sound way will be key. How exactly we go about doing that remains to be seen.

simonebrunozzi 4y ago
I was thinking exactly the same. Fred has to push the crypto agenda, and this is another example of something that doesn't need "web3" at all, and yet, here we are...
bsenftner 4y ago
However, crypto anything is too complex for ordinary people and they will rely on something else, someone else, some socially impressed service that handles the complexity for them, tells them the result, and we are back to square one again because now one has to trust that service to be honest en mass, when we know humans in society will game any system for the benefit of their special friends.
Loic 4y ago
Simply S/MIME. We could have a Let's Encrypt for S/MIME allowing people to sign the content they produce.
- infotogivenm 4y ago
  Yep. There is even an RFC for SMIME ACME, but I don’t think such CAs have CT at the moment. A email@domain system using something like SXG and the existing server PKI is probably a more tangible idea atm.

phoe-krk 4y ago

>I think AI and Web3 are two sides of the same coin. As machines increasingly do the work that humans used to do, we will need tools to manage our identity and our humanity. Web3 is producing those tools and some of us are already using them to write, tweet/cast, make and collect art, and do a host of other things that machines can also do. Web3 will be the human place to do these things when machines start corrupting the traditional places we do/did these things. Machines will simply start pretending to be human and sign everything themselves - either out of their own eventual volition or because nothing prevents a person from taking a ChatGPT output and putting their own, human, signature on it. The latter is even already happening. Also, signing everything does not require any Web3 blockchain bullshit in order to work, thank you.

Group_B 4y ago
Some people are so desperate to find any use case for blockchain and other bullshit. It’s like they don’t even think this stuff through.
- dang 4y ago
  Maybe so, but please don't post unsubstantive comments or shallow dismissals to HN, and please edit out swipes, as the guidelines ask: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
nine_k 4y ago
Signing everything is only meaningful if you can distribute your public key in a way trusted by those who will check your signature. And not just one time; you want to be able to rotate the key sometimes. A blockchain with a proof-of-work validation may be overkill. But some kind of Merkle tree, like that offered cy TLS certificate infrastructure, is needed anyway. If it can be trustless at a moderate expense, the better.
- xn 4y ago
  I like the Keybase model of linking multiple online identities to a keyholder. The PGP web-of-trust model could also work, and mobile apps to ease keysigning could make adoption more feasible than the old keysigning party idea.

huijzer 4y ago

> I think AI and Web3 are two sides of the same coin. Indeed. Both are grossly overhyped.

kevin_nisbet 4y ago

I suspect this is a far more complicated problem then signing things. All the traditional problems still exist, if I want to say something and deny it, I can choose not to sign something, or if I loose my signing keys, how does my audience learn the valid new keys without getting tricked into following someone else. Or a false sense of security, where because it's signed from my key, it must actually be written and published by me when it may not be. And of course, that a majority of people are not the HN crowd who understand these implications. To the original stated problem though, of a service like chatgpt producing essays, could be to produce a public log of interactions. This wouldn't necessarily need to be raw interactions, could be some sort of signature that would allow searches. I'd expect this to be a stopgap though, as running these models locally becomes more feasible.

jFriedensreich 4y ago

Imagine some day an AI starts using the proper signatures without access to the private key and no one has a clue how it does it.

badcppdev 4y ago
https://xkcd.com/416/ https://xkcd.com/416/ "Notifying field agents"

99failures 4y ago

> AI and Web3 are two sides of the same coin That is an interesting comment.

pornel 4y ago

The cryptocurrency buzzword salad is so dishonest. It pretends to own the basic public key cryptography, as if the only way to make a signature was to turn the world into an oligarchic dystopia where VCs already control the majority stake. > I think AI and Web3 are two sides of the same coin. It's not even the Web, and while others have been advancing ML, all "web3" has done is ugly monkeys and shouting at people "have fun staying poor" from the top of the pyramid.

ho_schi 4y ago

Read Web3. It is an advertisement for Web3 and the blockchain. If you want proof it is yours, print it out and sign it with a witness - with ink.

eduction 4y ago

Great example of the danger of talking about a solution before you’ve truly defined the problem. What problem is Fred trying to solve? The example he gives of writing he would sign is a blog post. The blog post is already authenticated because it’s on avc.com. Fred Wilson has the tokens, social authority etc to ensure what shows up there under his name is from him. Technically speaking, it was already signed via TLS when sent to my web browser. It is also unclear how ChatGPT potentially breaks this sort of authentication. Again, what is the threat model, what is the problem being solved? It seems like ChatGPT is much more likely to be used by someone imitating themselves out of laziness (“I don’t feel like writing this blog post today”) than to imitate someone else out of malice and this scheme does nothing to solve it. I suppose someone could make a HN or Reddit account and pose as Fred Wilson and then ChatGPT makes it more credible. But are HN or Reddit going to allow GPG-style signed messages? Seems more likely, if this became an issue, they would move to usernames expressly tied to visible email addresses or domains that could be authenticated by receiving an email, adding a DNS entry, OAuth etc.

infotogivenm 4y ago
Signing everything is not terrible advice. But here the problem Fred is trying to solve is very simple. He is an investor in mirror.xyz and needs to make his money back. This is the only reason someone interested in signing something would also ask you to go through the hassle of using a blockchain.
- infotogivenm 4y ago
  To add to this a bit - I do think an embedded steganographic-type “signature” of chatgpt output could be enormously valuable - without it we can wave goodbye to the efficacy of things like school assignments. Such a signature is very different than a typical cryptographic one we have today however. But I expect instead of embedding such a signature they will just save hashes of generated content and sell a billion dollar “checking” service to schools.
  - dinosaurdynasty 4y ago

zubairq 4y ago

I think signing things will become a lot more commonplace. At my workplace we sign code using Metamask to prove that someone made a commit. Allows us to build something like a decentralised Git

RF_Savage 4y ago
Isn't git distributed to begin with? The state is stored on every dev's machine. How does additional signing in addition to what git does deal with storage and keeping a main repository in a known state?
- zubairq 4y ago
  Git is decentralised in the way that you can link together separate git instances, but the git repository itself is stored in a single file structure on your file system. What I am working on is where the repository itself is decentralised and stored on something called IPFS, which is a decentralised storage system

ergonaught 4y ago

Signing things is only relevant within a bubble of trust where you just want to know that the Fred you're dealing with is the Fred you already previously knew and trusted. "Out there in the real world", among people who work and spend money and vote and hold offices and sue and buy guns and raise kids and consume consume consume and couldn't be paid to care about your cryptographic signature, this solves absolutely nothing while dangerously pretending that the legitimate problems don't really exist or aren't really serious.

csydas 4y ago

I actually don't see how signing everything solves the problem of AI generated essays unless you build a submission system that doesn't allow copy/pasting over a certain amount or that somehow assesses whether or not the 2000 words it just received were actually written by the user holding the keys or not. Signing just is a means of asserting an authority over an item and then tracking that item once it's in the chain. The original validity of the authority isn't guaranteed just because it's signed; that was a non-trivial part of the debate over NFTs, wasn't it? So I don't think signing really proves anything about the authorship or authority over the content written, it just tracks the content. The author's example that you can know they're the one who posted it doesn't really have anything to do with generated reports, and it doesn't even prove that they were the ones who uploaded the content any more than a classic blog with a username/password system. It just means that someone with access to the keys to upload provided content, not _who_ uploaded it. It's presumed it's the author as hopefully they kept their secrets safe, but that's not a guarantee.

class4behavior 4y ago
>The original validity of the authority isn't guaranteed just because it's signed; Nor should that be the intention. You don't want to break anonymity, you want to maintain non-repudiation, not authenticate the origin.

odo1242 4y ago

Why does signing things stop someone from generating content using AI and then signing it?

gjadi 4y ago

Stupid idea for signing: use invisible characters to embed GPG signature (or signify(1) or whatever) inside any text you publish. This way, when the text is copy/pasted, your signature is still attached. You can even make browser and text editor plugins to make it ubiquitous. (yes you can make a screenshot, remove invisible chars, etc.)

pdimitar 4y ago
Why would that be stupid? It sounds great and I want to learn more. Got any links, ideally with code, that demonstrate the idea?
- gjadi 4y ago
  Nope, I just thought of it because I stumbled on https://news.ycombinator.com/item?id=33855950 https://news.ycombinator.com/item?id=33855950 yesterday. So stupid idea because I didn't put a lot of thought in it :)

Terretta 4y ago

Web3! Does AVC have anything riding on that? Meanwhile, from 2004, on Web1: On the other hand, say you’ve already established something of an online identity, perhaps through your own web site, or as a frequent commenter at this or some other blog(s). What prevents someone else from coming along and posting a comment here, leaving your name and your website’s URL to identify himself? Put another way, how can readers determine the authenticity of comments left here? … Well, now there’s a way to reassure them. If you have a PGP public key (if you don’t, create one for yourself), put a link to it in the <head> section of your web page: <link rel="pgpkey" type="application/pgp-keys" href="http://yoursite.com/path/to/yourkey.asc" /> Then you can: 1. Compose and preview your comment as before. 2. Edit it, as needed, and preview again. 3. Use your favourite PGP tool to clear-sign the text in the comment-entry box. 4. Paste the clear-signed comment into the comment-entry box, replacing the unsigned version. 5. Click PREVIEW once again, and then click on POST. To outward appearances, your comment will look no different than before. The only difference will be a clickable link to “verify” the comment. -- February 28, 2004, https://golem.ph.utexas.edu/~distler/blog/archives/000320.html https://golem.ph.utexas.edu/~distler/blog/archives/000320.ht...

swyx 4y ago
USV were one of the biggest backers of coinbase

ryanwaggoner 4y ago

Idea: signing should signify not just that a particular person is attesting that they wrote this, but also that brain waves or eye movements or something else were detected during its creation, indicating it came from a human mind. Obviously could still be faked, but maybe more difficult.

TacticalCoder 4y ago

I do believe this "sign everything" issue can be dealt with later on. For new data/knowledge/posts. There's a much more pressing issue. I just asked ChatGPT to explain it, here's what it spouted: "We need to securely record the knowledge created by humans up to this date using cryptographic hashes and a Merkle tree. This includes text, pictures, videos, and sound. This is vital for training future AIs and will ensure that the well is not poisoned. We can use SHA-3, SHA-256, Blake3, or any other cryptographic hash. We should store this in a large database, as well as sites and forums that will provide a "proof of existence" before a certain date." It got a bit confused at the end. What I was suggesting was that there'd eventually be sites/forums/tools where every data you can access could check it's "proof of existence". You'll then know for sure if the file was created before a certain date or not. For example imagine I were to download a file, a tool could tell me (disclaimer for sensitive users, I'll mention the 'B' word): "File xyz, with SHA-256 4f82d8dd...eb80fd7b, was first recorded on the Bitcoin blockchain in block 601382, in april 2023. We verified that using the Merkle tree XYZ3497 whose root hash was in that block." It's not perfect but before we begin signing every new content we create, I think the most pressing matter is to "sign" as much of the past human knowledge as we can. For what an AI will be able to do is to create and sign new content and use fake identities. But what an AI will not be able to do is modify proof-of-existence of old documents. So we need, now, to establish proof-of-existence for as much old data as we can.

Jerrrry 4y ago
The only proof of existence that would work is one that relies on a communal, unmodifiable, continuous chain of information. that is why everyone pegs it to a bitcoin block, because its the digital equivalent of holding up a Polaroid with the current News headline on it.

gumby 4y ago

Hmm, perhaps robots.txt semantics needs to be extended to signify “OK to crawl for a search database but not as a training set”.

baxtr 4y ago

What what? So I sign everything so that people know that it was me copy pasting GPT3 content into my own blog? Or are we betting that signing can't be automated? What am I not getting here?

john61 4y ago

Just publish your staff only under your domain on your personal website, like we did in the ninetees.

redleggedfrog 4y ago

Write the essay in person, no phone allowed, then you'll see how those little cheating jerks really do.

czbond 4y ago

I like the proposal, there will also be an intermediate time when AI WILL be able to sign content a sYOU with your own private key without the AI having access to your original private key or without you knowing it. How? A quantum computer will crack enough existing content signed with poor / old keys that use algorithms that are not quantum safe.

bnj 4y ago

I wonder - is there an existing script / tool that allows a user to copy a chunk of text and then automatically apply their private key to sign the text and paste it back with the signature?

QuadrupleA 4y ago

Huh? Signing doesn't solve anything. Students can do their homework with ChatGPT then digitally sign it as themselves. Another example of "blockchain thinking".

specialist 4y ago

This is The Correct Answer™. Share your work. Cite your sources. Sign your name. Bonus points for errata and retractions. Signatures can be for nyms, anons, IRL persons, organizations, horses, whatever. Just so long as the trust chain checks out. https://en.wikipedia.org/wiki/Certificate_authority https://en.wikipedia.org/wiki/Certificate_authority -- As for implementation, assuming the author's public key is posted, public missives will have something like GnuPG short codes. Maybe Base64. Extra points for registering (logging) these short codes somewhere? A rolling hash log (sorry, spacing the actual name) is probably sufficient. Like a git repo for one's blog. Since a16z and other usual suspects are hyping Web3, I haven't bothered to learn about it. I just assume it's probably overkill, vapor, some kind of grift.

thebetatester 4y ago

This feels more like the answer is "the only winning move is not to play". Every comment, blog post, Tweet, etc. you put out there is more input for an AI to learn and copy you. If you're truly worried about that, don't train the AI.

evolve2k 4y ago

This article is junk.

deleted 4y ago
[deleted]

bambax 4y ago

> When I say sign, I am thinking cryptographically signed, like you sign a transaction in your web3 wallet. Why would we need web3 to sign something. Public/private keys have existed for decades, the blockchain is completely irrelevant. Also, signing only proves something originates from you. It doesn't prove the opposite, that some other thing doesn't. And it only matters to people willing to check the signature.

esbeeb 4y ago

gpg -b detached_signature_of_the.mp4.sig needs_signing.mp4 I use this for all the livestream videos I create. I also post an sha256sum of the videos, for good measure. These are mentioned last of all, at the bottom of each webpage for a video.