[rvanlaar]

It will catch random webmasters.

In short, Dutch hoster TransIP had to pause their scanning service. They got hashes that included default images from WordPress.

"Waar het misging, is volgens TransIP-woordvoerder Marco Edelman dat per ongeluk hashes van standaardafbeeldingen van WordPress-installaties en plug-ins zijn toegevoegd." [1] https://tweakers.net/nieuws/182766/transip-pauzeert-hashchec...

[rolandog]

With the high-likelihood of false positives, this is just another Child Benefits scandal waiting to happen if the system were to be completely unsupervised.

[GekkePrutser]

What's so worrying about this is that these stock images were added there in the first place. Clearly the process is completely broken, if there was any kind of human oversight this would have been caught right there.

Right now it was clear because it was an often-used package. What if it's something more niche next time?

[withinboredom]

It uses the MD5 of the image, no surprise there that there were collisions with ordinary files. I've run into MD5 hash collisions causing mayhem several times in my life (usually between unrelated email addresses, IIRC).

[readams]

You found 2 actual emails with the same md5? That sounds very unlikely. MD5 is weak against attack, but you're not going to be hitting collisions with "normal" data and especially not short strings.