6 ms·
Open Heart Protocol
- xlii 2y agoIt seems nice but every single time I see service allowing anonymous uploads like such I’m thinking immediately: criminal use. How hard would it be write a protocol that uses relatively safe urls to encode messages, e.g. by ensuring that the ratio of emojis isn’t serialized URL, credentials to some stash or an encoded picture no one wants to keep?
- graemep 2y agoWhat do you have in mind? It seems to only allow sending a single character at a time from a limited set. What criminal use does that allow?
- xlii 2y agoYou don’t need a upload a lot of data in order to have illegal data stash and there are creative criminals out there. E.g. for GPS coordinates you need only a 16 digits. Emojis are 8 bytes so by selecting specific ones and adding a control character (or two) and ensuring other stay in sequence you can encode this data in. And then I can only respond with „Did you read article on ACME Times about a car riding a bike?” which is a simple pointer for URL which you might check for the drop coordinates. This it’s also possible to provide encryption keys, url serialization, cryptocurrency wallet pointers etc. And sure, this seems complicated and dystopian but when government asks you to provide data of your users who committed hard crimes it’s not really fun to be at position when you say „I don’t know who my users are”. From my experience any service that allows anonymous write and anonymous read over long periods will sooner or later be used for illicit activity. It doesn’t matter if that’s 1mb or 10 bytes.
- goosejuice 2y agoSure, I guess that could happen. Hackernews allows anon data uploads over long periods. How many online services actually do KYC if they don't legally have to? Any motivated criminal could also just use a book cipher or any number of less trackable options.
- graemep 2y agoThe GET request does not return data in sequence, does it? Just counts fr each emoji. What exactly does the govt do if you do not have data they want? I assume if you run a service like this you would comply with any data retention requirements in your country and hand over logs - although older ones which you might have deleted to comply with other laws! Unless you have id verification crminals can sign up with false identities.
- xlii 2y ago> Unless you have id verification crminals can sign up with false identities. Having registration is enough to not be liable, that’s why everyone is doing that. You get subpoenaed, you give logs for user that you have, case closed. Data can be linked to your server. If you cannot pass the torch it’s you who will be investigated as potential partner in crime.
- bbor 2y agoWhy not just use pastebin for a "hey I left ur drugs at this coord", or even just a plain ol' encrypted message over email, Signal, etc...? I'm a little lost here, probably due to naivete. Is the storage of URLs or crypto wallet pointers really the bottleneck for cybercrime?
- xlii 2y agoBecause that way it’s easy to track both poster and visitor (one could say that every visitor of such URL was involved). Indirect communication shifts focus from channel to method. And if anyone can use channel and anyone can read message then it’s impossible to pinpoint true poster and true recipient. E.g. Few years back I was helping fix a Wordpress site which shared leaked CC through page visitor counters. Imaging proving anyone’s participation. And finally I didn’t say anything about it cybercrime, the cases I know of were related to identity theft, assets theft, extortion and illicit videos. Seized servers and personal computer for years.
- reaperducer 2y agoIt seems to only allow sending a single character at a time from a limited set. What criminal use does that allow? In the age of beepers, criminals found plenty of creative ways to send messages in just a few characters. And this permits emojis, which -- binarily speaking, contain far more bits than a beeper message.
- fizx 2y agoThe problem isn't that criminals can use your service, its that the service provider really doesn't want to be liable for that happening, which generally only happens when you host illegal content.
- _Algernon_ 2y ago>A Open Heart message should contain of a single emoji sequence
- LordDragonfang 2y agoA single emoji is a sequence (of bytes)
- _Algernon_ 2y ago"<thing> sequence" is generally taken as a sequence of <thing>. There is a certain ambiguity there.
- bbor 2y agoIt's just one :) https://github.com/dddddddddzzzz/open-heart-element/blob/main/src/index.ts#L34-L45 https://github.com/dddddddddzzzz/open-heart-element/blob/mai...
- triyambakam 2y agoSo the API rejects a lot of valid emojis from my reading of that
- isitnow 2y agoMay want to have a look at the linked count again “BBOR”: https://api.oh.dddddddddzzzz.org/github.com/dddddddddzzzz/OpenHeart https://api.oh.dddddddddzzzz.org/github.com/dddddddddzzzz/Op... https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
- LordDragonfang 2y agoHuh. ZWJ is an interesting corner case. Technically it's supposed to be used when combining emoji sequences that compose another single emoji (flags, skin color, gender, etc), but if the server doesn't discriminate for "real" emoji combos it technically can be an arbitrary combo.
- GuB-42 2y agoWith ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji. Particularly interesting are the "family" emojis, made by joining any number of person-type emoji with ZWJ characters. So in theory, a family made of thousands of men, women, girls, boys, etc... would be a valid emoji.
- isitnow 2y agoYup, ZWJ was my first thought, and yes, it works. Tried up to 4. Too lazy to push it to see how many joins until the api breaks. https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
- deleted 2y ago[deleted]
- labster 2y agoOttoman harem emoji is valid Unicode now.
- paulgb 2y agoThis nerd-sniped me, I wrote a tool for encoding arbitrary strings into one emoji: https://news.ycombinator.com/item?id=42829938 https://news.ycombinator.com/item?id=42829938 I tried with ZWJ but it turns out variation selectors were easier to make work.
- toomim 2y agoThe ultimate exploit is to create fake "likes". Once any system of likes becomes successful, it gets used for (a) filtering news feeds, and (b) establishing consensus & social truth. This is the biggest exploit there is. A cheap system for "likes", such as this, is only safe when few people use it. Once it becomes popular, and worth something, it gets exploited, and then utterly fails.
- egypturnash 2y ago"A Open Heart message should contain of a single emoji sequence. However, the emoji sequence may be followed by arbitrary data which the server is expected to ignore." Italics mine. That arbitrary data could be a multi-gigabyte zip file of some expensive program, classified data, copyrighted video/music,or anything for all this spec cares.
- NortySpock 2y agoOk, so? Provided the receiving server is configured to redirect the arbitrary data into the trash, you're in the clear, right? Not your fault someone sent you extra data, and you're not expected to keep it, and if you don't keep it anywhere, law enforcement could search your server but there's nothing to find because your system doesn't retain anything from the arbitrary data.
- atoav 2y agoYou are aware that computers also just use zeros and ones to enable everything that is around us?
- notatoad 2y agothat's really only a risk when you allow direct retrieval of the uploaded data. if you're only returning counts and you're not even offering a guarantee that every submission will be counted, then the potential for abuse isn't really any higher than any other website out there.
- xlii 2y agoByte value is a count of flipped bits. Those bits aren’t even guaranteed to be correct (see cosmic bit flipping) and yet our computers work this out. IMO this is risky because it’s easy to distribute upload, e.g. I could have infected, semi popular website that would submit distributed request on visit (think about it like 1000 credits daily to use to encode message). Visitors of this website wouldn’t see a thing and yet the encoded message would be consistent. As for other websites - especially free image hosts - they often keep a metric ton of data, some won’t work if you won’t have an identifiable partner cookie on submission request, and there is post upload analysis etc.
- notatoad 2y agolike yes, theoretically somebody could probably manage to encode a few bytes of secret message. but it's just that there's so many easier and better ways to do that, and even if they managed to accomplish it here it's hardly hurting this project - worst case scenario it's a bit of unwanted noise. it seems very silly to worry about it.
- AnthonyMouse 2y ago> It seems nice but every single time I see service allowing anonymous uploads like such I’m thinking immediately: criminal use. This seems like the Hollywood movie plot criminal use. Actual criminals just put a normal server/proxy in a non-extradition country or compromise any of the zillion unpatched Wordpress instances on the internet or something equally boring.
- deleted 2y ago[deleted]
- Pannoniae 2y agoMight I say that this whole safetyist moral panic is very convenient for large corporations? If you can't host your own service due to these concerns, you'll use the cloud :)
- XorNot 2y agoIt's not a moral panic it's called "an extended engagement with law enforcement will be unpleasant and costly" and you probably don't want that. And if you're wondering why it's that way, then casually observe everytime people declare that people under arrest or being tried "don't deserve..." something.
- AnthonyMouse 2y agoThe problem here is that we keep acting like the way we should solve this is by having people making toy projects or general purpose tools cower in fear of their own government and stop trying to make anything, instead of establishing a government that can distinguish between violent drug cartels and child abusers vs. innocent behavior or minor offenses and then not inflict senseless damage on the latter.
- teddyh 2y agoGovernment is incentivized and rewarded for finding and punishing violent drug cartels and child abusers. When those become hard to find, the government punishes minor offenses, since it is easy to paint these as hardened criminals, and nobody is in a real position to discover or publicize the actual state of things.
- AGorilla 2y ago[dead]
- teddyh 2y ago<http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-speedchat-or-blockchattm-from-disney-finally-arrives/ http://habitatchronicles.com/2007/03/the-untold-history-of-t...>
- xrd 2y agoIs this a decentralized like button? It's an interesting alternative to webmention (as is mentioned).
- chrisco255 2y agoYeah or more like a decentralized reaction button with any emoji.
- pedrovhb 2y agoThis seems centralized, though you can self-host it.
- seydor 2y agoHere's me thinking it would be some open source artificial heart designs.
- asciii 2y agoYeah I thought this was some Pacemaker design stuff.
- a1o 2y agoI thought it was about digital communication over 4-20mA devices.
- tedgold 2y agoIs it Heartbleed again?
- xyst 2y agoThe ticker inside every H. sapien is the only design you need. Thanks to evolution, it's been perfected over ~4B years.
- tuatoru 2y agoYeah, no. Look up "sick sinus syndrome" and "premature ventricular complex". (The latter occurs in up to 75 percent of people at times.) 4B years, yes, but evolution is a pile of kludges on top of kludges.
- kamma4434 2y agoEngineering in general is a pile of kludges on top of other kludges. Theory looks good in physics textbooks but it hardly ever survives contact with reality
- topaz0 2y agoThe most pervasive misunderstanding about evolution is that it leads to "perfection". Sure it is a kind of optimization procedure, but a) it's optimizing on a loss function that is measured on the population scale, not the scale of a particular organ, so don't expect your pet figure of merit to be optimized even in an average sense, and certainly not in an individual; and b) there is not a unique optimum, the optima are not stationary, and local optima generally are not all that sharp, so do not expect the population to be all that close to the optimum either.
- omk 2y agoI like the way this being proposed in a decentralised manner. Kudos to the author for the effort and thought put in. However, I am curious what the incentive for publishers is to adopt this standard if those emojis are only relevant for the websites own silo? Use cases like these call for customized deep integrated implementations. My question is a curious one. I might be missing the big picture and would like to get educated.
- _ix 2y agoThis is dumb; I love it.
- clueless 2y agoso one needs to pay for a cloudflare account for this to work?
- helsinki 2y ago”The response should be a JSON object mapping Emoji (as Strings) to their count (as Numbers)” This means ordering semantics are lost.
- Retr0id 2y agoWhy would you expect/want ordering semantics here?
- LordDragonfang 2y agoFor many services which allow arbitrary emoji reactions (most notably discord) they remain ordered by "first reacted" order, which can allows emergent behavior like spelling out words with the letter emojis
- Retr0id 2y agoSpelling out words feels like an anti-feature in this context
- dagss 2y agoPurely rationally it may be. But lots of fun being had in our Slack by people putting emojis in the right order, to make pictograms etc All forms of communication is "abused", such abuse is part of being human, that is how languages have evolved..
- grayhatter 2y agoI think misused is connotation you really want. unintentional irreverence versus unintentional maliciousness
- Spivak 2y agoBut JSON mappings are ordered. The thing producing/consuming them might choose to map them to an unordered mapping but inherent to them being serialized is you get an order for free.
- mg 2y agoIn theory, Bluesky, Mastodon, Pixelfed etc could offer a service where you drag and drop the button onto the Bluesky/Mastodon/Pixelfed website where you are logged in and sign the reaction in your name. And send the post with a signed message like "Peter Prima endorsed this page with a thumbs up emoji /signed: Peter Prima" This way, the web would get a decentralized like system.
- citizenpaul 2y agoYeah this wouldnt't be massivly exploited. /s Too bad the modern internet is a monitized cesspool. This is a cool idea.
- blackeyeblitzar 2y agoThis reminds me of the browser plugin that adds commenting for any website you visit. Whatever happened to that?
- Jolter 2y agoI purposely installed a browser plugin that removes comment sections from web sites. I really don’t know why anyone would want to add one.
- blackeyeblitzar 2y agoI think it was to be able to discuss things on websites that removed comment sections or that had a lot of heavy moderation that prevented meaningful discussions.
- ben0x539 2y agoThe problem with comment sections on web sites is that the web sites are incentivized to have shitty comments for engagement and ease of moderation. If it's a browser plugin, it's out of the website's hands and as the user I could probably configure it so I only see comments from people I think are good at commenting, like my friends or people I follow on social media.
- discardedrefuse 2y agoI feel like this existed in the 90's; Basically a web browser where every page was a chat room. Maybe I'm confusing it with ThePalace or WorldsChat.
- teddyh 2y agoThere is Zeeker <https://addons.mozilla.org/en-US/firefox/addon/zeeker/ https://addons.mozilla.org/en-US/firefox/addon/zeeker/>, but there seems to be no new versions recently, and I cannot find a link to the browser add-on on their web site, so they might have abandoned it. There was also “Dissenter”, still available at <https://github.com/gab-ai-inc/gab-dissenter-extension/releases https://github.com/gab-ai-inc/gab-dissenter-extension/releas...>, but the website seems to have pivoted to something else, and the add-on seems to have been removed from the official add-on repositories (possibly due to negative press coverage: <https://archive.fo/sWxAS https://archive.fo/sWxAS>). Further discussion: <https://discourse.mozilla.org/t/the-removal-of-the-dissenter-extention/38140/90 https://discourse.mozilla.org/t/the-removal-of-the-dissenter...> and <https://www.reddit.com/r/browsers/comments/ptaau2/what_happened_to_dissenter/ https://www.reddit.com/r/browsers/comments/ptaau2/what_happe...>
- davidw 2y agoThis reminds me a bit of 'visitor logs' from the 1990ies.
- marcodiego 2y agoHow about an "open comment protocol" so we could finally get rid of the siloed internet we have today?
- jasonjayr 2y agoSMTP?
- qingcharles 2y agoUSENET?
- discardedrefuse 2y agoBut we need silos to protect your data from greedy AIs...So we can better package it and sell it to wealthy AIs.
- IncreasePosts 2y agoWho is going to deal with spam?
- immibis 2y agoUse ATproto, but with a different data model so that each "post" is associated with a URL being commented on. Then bring the moderation system from Bluesky. (As much as I don't like ATproto's centralization, ActivityPub doesn't work the right way)
- NelsonMinar 2y agoTrackbacks! (No, don't do trackbacks again.)
- AutistiCoder 2y agoi don't see how that's going to make the internet any less siloed? unless you're trying to say it'll make us less reliant on services like Disque.
- koolala 2y agoSo one person can send 10 hearts + some rate limit? Feels like if this took off it would be like a cookie clicker.
- raldi 2y ago> If reaction counts are write-only, the server should respond with a 403 or a 404. Wouldn't HTTP 204 be more appropriate here? A 4xx would make it seem like the request failed, when in fact it succeeded.
- prezjordan 2y agoTIL Intl.Segmenter[0]. The ECMAScript standard library never ceases to amaze me. [0]: https://github.com/dddddddddzzzz/api-oh/blob/312d490641c7ec76ff02e9981481ae1469131075/src/worker.js#L112 https://github.com/dddddddddzzzz/api-oh/blob/312d490641c7ec7...
- varun_ch 2y agoThis reminds me of one of my favorite web things: https://incr.easrng.net/ https://incr.easrng.net/ It's a little button counter in an iframe that you can embed on your website. It also looks great next to 88x31s.. I have one in my footer https://varun.ch/ https://varun.ch/ I think I just love the idea of making static pages a little more interactive by adding in these little widgets. I have an HTML form embedded on my contact page that's hooked up to `ntfy` and acts like a 21st century pager. So much fun.
- deleted 2y ago[deleted]
- nine_k 2y agoI love the idea of a completely open protocol that thwarts spam by being unable to post any text at all, only tiny predefined pictures, aka emoji. The obvious abuse will be, of course, pumping some counters to ridiculous values, making them useless as a measure of readers' reaction. Though it can be lighthearted fun in the spirit of the Web form 1994, I suspect that implementing caps could be useful. Less fun could be posting tons of negative emoji (anger, crap, etc). Some site owners will limit the set of allowed emoji to only positive reactions, as seen in some large Telegram channels currently.
- delichon 2y agoI like this idea but think there is a missing link, literally. It needs a built in way to notify URL A of a reaction to URL B, so that reactions can be recorded independently of the target URL. Like putting URL B in a query parameter. This would support repositories of reactions that are independent of the reactee, and not subject to their feelings on the matter.
- kotaKat 2y ago... tried to use the curl commands as-is from the documentation and immediately get slapped by bot protection. :')
- isitnow 2y agoArbitrary length strings (unsure exactly how arbitrary, I’ve tried up to 4) can be stored using zero width joiners. https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
- KPGv2 2y agoCan someone explain what the motivation for this protocol is, and why it merits the name "protocol"? It looks like regular old HTTP to me. (I earnestly hope I'm wrong, because I'll learn something new and cool.)
- imoreno 2y agoSeems like a decentralized like button. But without any quality control on the data, so the number of likes is meaningless.
- KPGv2 2y agoIf it's a decentralized like button, why is a new protocol needed? `PUT /count/increment` is a pretty straightforward RESTFUL solution over the existing HTTP protocol.
- deleted 2y ago[deleted]
- AutistiCoder 2y agoyeah, I'm not getting the significance here either. admittedly, it's a good project for an entry-level dev's portfolio, but that's about it.
- grayhatter 2y ago> [...], so the number of likes is meaningless. uh... I'm not sure you and I use the same definition for meaningful.
- corytheboyd 2y agoAccepting arbitrary input is a complexity that will be abused. Why not lock it down to a limited set of inputs… or just a heart? `POST /openheart/heart{?url}`