"Soon, digital memories will be just like real ones — slightly different every time we look back, but with no way of knowing what's changed ..."

Well, let's see:

ssh [email protected] sha256 photos/IMG_1234.HEIC

Yep, checks out.

Expecting general users to use checksums is exactly the answer I expect from HN.

why do you assume GP is talking about general users? as you point out, this is HN: it’s reasonable to think that most comments here are written for that mostly-tech-literate HN audience, unless they state otherwise, no?

Yeah. And somebody may put up an Open Source repo for doing that 'easier'. But of course, nothing that any average user on the net could even know to exist, leave aside actually use...

A solution around archive fidelity isn’t far from this idea though. And how hard is it to sling a find command to collect all your photo hashes?

Extraordinarily difficult, judging by GP's cynicism. Personally it is appalling just how little people are motivated to be nomically tech-literate in this extremely tech-driven society.

Tech is the only industry that asks this of it’s users, it’s just laziness on the developers part. People needing to know about hashing in order to save photos would be like people needing to know what refrigerant their A/C uses in order to keep cool.

Can you? Sure. Are their weird edge cases where it’s mildly helpful to know as opposed to having to ask someone? Debatably. Should you need to in order to not have things break for no reason? Absolutely not.

Lots of things are complex and confront people to deal with it directly, we just also have legions of people that we can pay to step in for us and a culture where laziness and convenience are core principles to our everyday lives. Not to mention a political establishment that touts the "virtues" of a simple, ignorant life.

Maintaining a house or yard, for example, or taxes. Driving also has a pretty high learning curve -- high enough to mandate driving lessons -- but once we learn it we're set for life. (Tech is the same way here....)

I kind of agree with you both. We do ask a lot of our users. But also, there is no A/C system out there nearly as complex as software. It is hard. For everyone. We can do better, but what does that even look like? Consumer level technology consumption is not in a great spot, but it also isn’t horrible. Power users who can get more out of computing will be a thing for a long time to come.

Sadly, you stored only the MD5 back then.

We don't store any checksums - we just store your files.

The checksum commands:

(md5, sha1, sha224, sha256, sha384, sha512, sha512t256, rmd160, skein256, skein512, skein1024, cksum)

... are available to run as you see fit.

I think you misinterpreted the comment you're responding to; they meant that "sadly, you [the user] never thought to store a high-quality hash (e.g. SHA256) for integrity comparison with your stored data; and the hash you did decide to archive for integrity-comparison was a low-quality one (e.g. MD5) that can be trivially preimage-attacked such that a cloud provider could silently replace your data with a different one — with the same low-quality hash — without your knowledge."

Nothing about rsync.net per se, other than the general idea that any data you put on "somebody else's server" can't be trusted to stay the same if you don't have a high-quality integrity-comparison content-hash of that data kept somewhere.

MD5 still has no known preimage attacks. Neither does MD4, for which collisions are absolutely trivial to generate.

To be fair, it may yet turn out that MD5 is (and has always been, we just didn't know it yet) a low-quality hash that can be trivially preimage-attacked. I think that's unlikely[0], but I can easily imagine someone reasonable being a bit more pessimistic. I certainly wouldn't willingly rely on MD5 preimage resistance for anything important.

0: I'd be willing to bet money at 1:1 odds that MD5 preimages still cost at least 2^96 bit operations (out of a nominal 2^127 hash invocations) 5, 20, or 100 years from now.

MD5 is weak against malice but still much stronger than something like CRC if your goal is to detect random corruption.

No, it's not. MD5 can still protect you from someone modifying the file without changing the hash.

ZFS defaults to fletcher4 for checksum. It has never had MD5 support.

> Nothing a little Stable Diffusion can't fix.

As someone who works in generative modeling, that's probably what is creating these issues in the first place. Kinda like how you can see certain GAN type of patterns on Netflix when there is upscaling or if you don't turn off the fancy features on your TVs. Of course, finding how these images are corrupted leads to better models so they will be solved. This isn't the first time Google has edited photos and made them worse and it won't be the last. But the trend is that the photos get better.

That's already what browsing most websites feels like.

How can your Photos library be real if our eyes aren't real? /s

> How can [X] if [false premise]?

By the principle of explosion[0, eg].

0: https://en.wikipedia.org/wiki/Principle_of_explosion

> with no way of knowing what's changed

You can just hash them locally or use AI to identify modifications.

The promise of the cloud was that you don't need local storage, because Someone Else will remember things for you, and you just ask them what you remember. This is also the problem of the cloud.

"The promise of the cloud was that you don't need local storage, because Someone Else will remember things for you ..."

Agreed. And that promise has been fulfilled - although it costs more than nothing and you need to do your homework.

You know these providers are proven bad actors. You know their business model(s) are antagonistic to your goals. You also know there are stable, time-tested alternatives.

What did you think was going to happen here ?

I would say at least partially aligned with your goals otherwise why would you use them in the first place?

They’re unaligned with rsync.net’s goal of getting people to pay for services.

Edit: to pay a minimum of $12/month??

ok and then what? :D you still can't recover original

Exactly..what is proof of existence for $400 Alex

> slightly different every time we look back, but with no way of knowing what's changed

This is already the case with different image compression algorithms improving on one another. Users couldn't and shouldn't tell the difference between JPG, or slightly smaller / resized JPG, or WebP, or whatever. I personally don't think image hosts should have to alert users when making undetectable changes to their images like this.

I'm sorry, but JPEG compression is extremely noticable especially with non-photographic material such as web graphics. The compression is lossy by nature, and predictably introduces noticeable artifacts. WebP on the other hand has support for lossless encoding.

It's simply not the same thing. If I opened my file browser one day and saw that all of my FLACs had been converted to MP3, I would go on a murder spree.