wingman-jr's comments

While the article's a fun exploration, I do wonder if the key point of the XOR cipher was actually to allow the manufacturer to claim that encryption was in use so that the DMCA could be invoked and make reverse engineering illegal.

I grew up with Hypercard etc. and always loved the classic icons, like these: https://99percentinvisible.org/article/designed-with-kare-in... Don't suppose you've ever extended the timeline further back? I bet there would be some interesting discussion!

I found this: https://textslashplain.com/2016/03/06/using-https-properly/ Seems like it at least partially corroborates OP's recollection!

Agreed. These technologies are the backbone of a lot (most?) of IoT devices, so unlike the article's description of "devices" in terms of "consumer handheld phones (that are often replaced every 3 years)", the impact here would be much deeper. And these technologies have been and are continuing to be sold as stable. For example, see https://www.nordicsemi.com/Products/Wireless/Low-power-cellu... . Quote: "Future-proof: LTE-M and NB-IoT are slated for support beyond 2040, ensuring devices' long lifespans. Subscriptions guarantee a reliable network, in contrast to other LPWANs that could shut down preemptively, risking your business." On the other hand, I guess I haven't seen as many IoT devices choose T-Mobile as a carrier either, so maybe it's just that T-Mobile knows their market.

I have worked at such a place as well and would strongly recommend this. If it works out right, you can remain in software and do adjacent jobs to manufacturing. I suspect industrial / specialist products would be the better side to get in on, at least at first.

This is an interesting article, and the subject of alternate paths to payment seems quite relevant. It listed a strategy or two I hadn't seen before. What other strategies have folks from HN seen? Did they work or not?

Fair point. But putting on my user hat, that Smart Paste sounds pretty handy if it works half decently. I'm thinking CRM entry use cases and the like.

My experience was quite a bit different than SWE. For me, it was as part of a R&D group and was more closely assigned to say, signals processing and my coworker was a physicist. The big change was that the skillset was more in rigorous thinking about the model itself and challenging how it worked. I had other parts to wireup the AI/ML that were more SWE for sure, though. What was your experience like?

Yeah, I went looking for debug.exe on the listing as well. There was something just so visceral and direct about its usage that I enjoyed.

If memory serves correctly, I think that's close to how ClickOnce worked/works? - but Windows only. One of the apps I worked on does it, but it was a homegrown framework. Definitely the sort of thing it's nice to delegate to a specialized system where possible.

As an interesting contrast, I work on a WPF app professionally that has been around for sure since .NET 3.5 (with references to .NET 2.0 DLL's at times) - at least 12 years - and as much as we give MS crap for abandoning WPF, I can still crank the project open in the latest Visual Studio, probably transparently upgrade to .NET 6 - and everything just works. There are a lot of advantages to web-based frontends but sometimes I think desktop apps are underrated from a stability perspective.

For a side project of image classification, I use a simple folder system where the images and metadata are both files, with a hash of the image acting as a key/filename - e.g. 123.img and 123.metadata. This gives file independence. Then as needed, I compile a CSV of all the image-to-metadata as needed and version that. Works because I view the images as immutable, which is not true for some datasets. On a local SSD, it has scaled to >300K images. Professionally, I've used something similar but with S3 storage for images and Postgres database for the metadata. This scales up better beyond a single physical machine for team interaction of course. I'd be curious how others have handled data costs as the datasets grow. The professional dataset got into the terabytes of S3 storage and it gets a bit more frustrating when you want to move data but are looking at thousands of dollars projected costs for egress of the data... and that's with S3, let alone a more expensive service. In many ways S3 is so much better than a hard drive, but it's hard not to compare to the relative cost of local storage when the gap gets big enough.

Also, Tensorflow.js WebGPU backend has been in the works for quite some time: https://github.com/tensorflow/tfjs/tree/master/tfjs-backend-...

Thanks for the response dynamite-ready. There's a lot in here, but I'll try to comment on a couple items. Some of your suggestions I've actually thought about extensively, so perhaps you'll find the reasoning interesting?

Regarding the current state of tech: I agree the tech still has quite a ways to go. I think one of the most interesting aspects here is how e.g. NSFW.js can get extremely high accuracy - but not necessarily perform better in the real world. I think it speaks in part to the nature of how CNN's work, the nature of the data, and the difficulty of the problem. Still, having seen how incredibly good "AI" has gotten in the last decade, I have quite a bit of hope here.

Regarding putting it on a server: that is indeed a fair question, but my desire is to keep the scanning on the client side for the user. In fact, it was actually the confluence of Firefox's webRequest response filtering (which is why I didn't make a Chrome version) and Tensorflow.js that allowed me to move from dream to reality as I had been waiting prior to that time. I can't afford server infrastructure if the user base grows, and people don't want to route all their pictures to me. So I guess I see the current way it works as a bonus, not a flaw - but it DOES impact performance, certainly.

Regarding data collection with respect to server - yes, this is something I've contemplated (there's a GitHub issue if you're curious). There are, however, two things that I've long mulled over: privacy and dark psychological patterns. Let me explain a bit. On the privacy front - it is not likely legal for a user to share the image data directly due to copyright, so they need to share by URL. This can have many issues when considering e.g. authenticated services, but one big one also is that the URL may have relatively sensitive user-identifying information buried in its path. I can try to be careful here but this absolutely precludes sharing this type of URL data as an open dataset. On the psychological dark patterns front - while I'm fine with folks wanting to submit false positives, I think there's a very real chance some will want to go flag all the images they can find that are false negatives (e.g. porn). I don't think that type of submission is particularly good for their mental health or mine. So, in general, I think user image feedback is something that would be quite powerful but needs a lot of care in how it would be approached.

Regarding the UX - thanks! And you're welcome to try the model as well - I've tried to include enough detail and data to allow others to integrate as they wish: https://github.com/wingman-jr-addon/model/tree/master/sqrxr_... Also, let us know how things go if you try out Darknet.

Good luck!

Jump point search is also pretty nifty for a block-based subset of pathfinding.

For whatever reason, animated Pokemon were a particularly tough case - I remember Charizard in particular being a tough offender for false positives. I cannot find a reference to it now, but I distinctly remember that at one point Yahoo's open_nsfw also had issues with Pokemon (although these two networks do not have a common lineage). Why would these cause problems? Not sure - maybe something to do with gradients of near-skin-tones.

You're right that stuff is quite difficult. I write a Firefox addon (https://addons.mozilla.org/en-US/firefox/addon/wingman-jr-fi..., https://github.com/wingman-jr-addon/wingman_jr) and train an associated NSFW model (https://github.com/wingman-jr-addon/model) - I've been at it for a few years now, and have had to plug many specific edge cases.

   - Babies (https://github.com/wingman-jr-addon/wingman_jr/issues/22)
   - Beach volleyball (but this definitely has SFW and NSFW variants, based on a somewhat subjective line)
   - Athletes in general. The model particularly thought some American football players were NSFW for a long time.
   - Swimming
   - Yoga - again, most SFW and some NSFW here but it still struggles
   - Wrestling was a tough one for sure
   - Pokemon

While indeed tough, I've seen definite progress. So it's not just a matter of tech, but also of considering the human element - the state of the art may not be up to the challenge of perfection, but it is definitely up to a point of true utility for some use cases. I'm happy about that.

As a note, it uses an EfficientNet Lite L0 backbone - I'm a bit limited in what type of scanning I can perform in a sufficiently speedy manner.

I also agree on the context for sure - one reason I haven't tried switching to an object detection method (and that I don't rely heavily on truly random crops) is that the focus of the image is highly important for the NSFW-ness in some cases. True, two images may contain the same content ... but one is far worse than the other. The nature of CNN's still has some of this location-invariance baked in, but I don't want to exacerbate it.

One challenge I think the OP may run into here that may also not be immediately obvious is that accuracy on image stills does not translate that well to video. I have basic video support in my addon, and while I knew there would be some differences, I was surprised at how many discrepancies there really are. As two examples:

   - Images in video are often blurrier. In true still images, there is a somewhat higher prior involved with amateur NSFW content and blurriness. This can be a source of false positives.
   - The opposite of the note above about focus. Taking stills of moving images will have many transitory frames that seem inappropriate on their own because it seems as if they are focusing on something when in reality the camera is just panning - obvious to the human, less so to the model trained on stills.

At any rate, given how well your list of edge cases coincided with failures I've grappled with, I'd be interested to see how well you think my addon stacks up for still images when set to stay in "normal" mode. I'd love to hear any feedback you have via GitHub so I can make it better.

Probably the humidity. In the western part of North Dakota, it's generally a bit dry so it doesn't _feel_ quite so cold. That's a big difference from even say, Grand Forks or Fargo which are right next to the Red River.

I'd recommend trying to work a place that has both web dev and the role you want, then try to move within the company itself after some time there. Could be more gradual and you can see what the day-to-day work is like before you jump in.

I have a WD MyBook and unplugged it last night - still fine, fortunately. I ssh'ed in and renamed the factoryRestore.sh and wipeFactoryReset.sh to cripple the attack as well as removing one drive from RAID until I can get an airgapped backup.

However, that doesn't fix the actual vulnerability itself. Anybody else affected have a suggestion for how to e.g. upgrade the relevant packages to make this secure?