Does it mean that even people who reside outside jurisdictions touched by the age verification craze will have to deal with all this?

> use facial age estimation

Surely a kid won't be able to ask someone else to pass the check for them. But let's talk about false positives. If the estimator falsely declares someone an adult, is Discord legally liable?

> submit a form of identification

If you have a picture of an ID document, can you verify that it's real? You'd have to ask the government for that. And at least in one country there is no process for that.

> On-device processing

Oh, a client-side check. Must be secure.

What is the purpose of such loop? Bots can simply switch to another residential proxy when the captcha success rate gets low. For normal humans, it is literally "computer says no".

[1]: https://www.destroyallsoftware.com/talks/the-birth-and-death...

Microsoft can simply change Recall to capture DRM-marked content too. And to avoid copyright issues, it will store some kind of visual summary (or whaterer the neural network can use) instead of plain screenshots like it is doing now.

[1]: https://github.com/melontini/bootloader-unlock-wall-of-shame

[2]: https://xdaforums.com/t/future-of-unlocking-bootloaders-in-a...

I had an idea about amost-privacy-preserving system by involving government ID and blind signatures:

1. The service passes a random string to the user. 2. The user authenticates to their government and asks the government to sign it. 3. The government applies a blind signature which basically says "this user/citizen hasn't registered an account in the last 60 minutes". 4. The government records the timestamp. 5. The user passes the signature back to the service.

Upsides:

* Bypassing this would be orders of magnitude more expensive than phone numbers. * Almost private

Downsides:

* Won't happen. Remote HW attestation is likely to win :( * The service knows your citizenship * The gov knows when and how often you register. * Any gov can always bypass the limits for themselves.

I think it may be also possible to extend it so that the government attests that you have only one account on the service but without being able to find which account is yours.

I believe the website tried to find videos with least bias possible by doing some clever searches using YouTube API (so not just videos titled IMGXXXX). Maybe it was trying to do partial matches on video ID.

https://plingbang.github.io/morsel/

Anyone who got the link should be able to delete the file.

This should deter one from using the file sharing tool as free hosting for possibly bad content. One can also build a bot that deletes every file found on public internet.

https://api.isfizzbuzz.xyz/api/15000000000000000000000000000...

BTW, there are neat divisibility rules which can give you the answer in practically linear time when the number is in decimal: https://en.wikipedia.org/wiki/Divisibility_rule

    ssh whoami.filippo.io

I'm really curious how this was presented to the user. A table with timestamp, filename, line number, and line contents? Or something more advanced?

I don't understand why there isn't "continue at your own risk" button. Maybe with a scary warning. It's kind of stupid that I have to spoof UA for a website to let me in. And in most cases, everything just works fine.

Maybe one day I'll create a website to inform about the issue.

I don't see how encryption at rest could've changed the outcome.

In the article, the cloud provider, which has full control over the VMs, was compromised. The VMs were hosting various Bitcoin services, which needed continuous wallet access for operation. So, I'd say there was no data at rest to be secured. The attackers could theoretically patch the application to make malicious transactions or just extract the wallet from RAM.

Also, the article suggests that the attackers were getting inside the running VMs rather than accessing VM storage directly.