Open Heart Protocol

Might I say that this whole safetyist moral panic is very convenient for large corporations? If you can't host your own service due to these concerns, you'll use the cloud :)

It's even more boring: When I share criminal data (usually old movies that are still in copyright), I just put them in an encrypted 7zip archive and upload to google drive, then delete after my friend downloads it.

I mean, in this case we're talking about emoji, so I'm having a hard time picturing the criminal use, but in general anonymous file uploads or text uploads absolutely get used by criminals as soon as they're discovered. Anyone who's run a service for long enough will have stories of the fight against spam and CSAM (I do!).

The ultimate exploit is to create fake "likes". Once any system of likes becomes successful, it gets used for (a) filtering news feeds, and (b) establishing consensus & social truth. This is the biggest exploit there is.

A cheap system for "likes", such as this, is only safe when few people use it. Once it becomes popular, and worth something, it gets exploited, and then utterly fails.

"A Open Heart message should contain of a single emoji sequence. However, the emoji sequence may be followed by arbitrary data which the server is expected to ignore."

Italics mine.

That arbitrary data could be a multi-gigabyte zip file of some expensive program, classified data, copyrighted video/music,or anything for all this spec cares.

With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.

Particularly interesting are the "family" emojis, made by joining any number of person-type emoji with ZWJ characters. So in theory, a family made of thousands of men, women, girls, boys, etc... would be a valid emoji.

>A Open Heart message should contain of a single emoji sequence

You are aware that computers also just use zeros and ones to enable everything that is around us?

It seems to only allow sending a single character at a time from a limited set. What criminal use does that allow?

In the age of beepers, criminals found plenty of creative ways to send messages in just a few characters. And this permits emojis, which -- binarily speaking, contain far more bits than a beeper message.

You don’t need a upload a lot of data in order to have illegal data stash and there are creative criminals out there.

E.g. for GPS coordinates you need only a 16 digits. Emojis are 8 bytes so by selecting specific ones and adding a control character (or two) and ensuring other stay in sequence you can encode this data in.

And then I can only respond with „Did you read article on ACME Times about a car riding a bike?” which is a simple pointer for URL which you might check for the drop coordinates.

This it’s also possible to provide encryption keys, url serialization, cryptocurrency wallet pointers etc. And sure, this seems complicated and dystopian but when government asks you to provide data of your users who committed hard crimes it’s not really fun to be at position when you say „I don’t know who my users are”.

From my experience any service that allows anonymous write and anonymous read over long periods will sooner or later be used for illicit activity. It doesn’t matter if that’s 1mb or 10 bytes.

Byte value is a count of flipped bits. Those bits aren’t even guaranteed to be correct (see cosmic bit flipping) and yet our computers work this out.

IMO this is risky because it’s easy to distribute upload, e.g. I could have infected, semi popular website that would submit distributed request on visit (think about it like 1000 credits daily to use to encode message). Visitors of this website wouldn’t see a thing and yet the encoded message would be consistent.

As for other websites - especially free image hosts - they often keep a metric ton of data, some won’t work if you won’t have an identifiable partner cookie on submission request, and there is post upload analysis etc.

And 405 response must include `Allow: POST` header.

Oh, I misread. Indeed, 4xx makes sense for a GET.

For many services which allow arbitrary emoji reactions (most notably discord) they remain ordered by "first reacted" order, which can allows emergent behavior like spelling out words with the letter emojis

The JSON specification describes objects as unordered. Which means any standards compliant JSON encoders or decoders can and will produce maps in different orders even when the same object is passed through twice.

It’s also worth noting that quite a few languages don’t guarantee ordered maps either.

If you want an ordered map then you really need a key/value map inside an array:

   [
     {
       Key: “:thumb:”,
       Value: 4
     },
     {
       Key: “:smile:”,
       Value: 1
     }
   ]

Though in this specific instance, you’d be better off with more specific key names like “emoji” and “count” (respectively).

Edit: HN stripped the emojis from my comment so I added ASCII placeholder strings into the example to illustrate the same point.

Not by the spec. Some implementations may preserve the order, but the JSON spec doesn’t guarantee that, so you cannot rely on it.

The problem with comment sections on web sites is that the web sites are incentivized to have shitty comments for engagement and ease of moderation. If it's a browser plugin, it's out of the website's hands and as the user I could probably configure it so I only see comments from people I think are good at commenting, like my friends or people I follow on social media.

I think it was to be able to discuss things on websites that removed comment sections or that had a lot of heavy moderation that prevented meaningful discussions.

If it's a decentralized like button, why is a new protocol needed? `PUT /count/increment` is a pretty straightforward RESTFUL solution over the existing HTTP protocol.

> [...], so the number of likes is meaningless.

uh...

I'm not sure you and I use the same definition for meaningful.

Use ATproto, but with a different data model so that each "post" is associated with a URL being commented on. Then bring the moderation system from Bluesky.

(As much as I don't like ATproto's centralization, ActivityPub doesn't work the right way)

USENET?

The most pervasive misunderstanding about evolution is that it leads to "perfection". Sure it is a kind of optimization procedure, but a) it's optimizing on a loss function that is measured on the population scale, not the scale of a particular organ, so don't expect your pet figure of merit to be optimized even in an average sense, and certainly not in an individual; and b) there is not a unique optimum, the optima are not stationary, and local optima generally are not all that sharp, so do not expect the population to be all that close to the optimum either.

Yeah, no. Look up "sick sinus syndrome" and "premature ventricular complex". (The latter occurs in up to 75 percent of people at times.)

4B years, yes, but evolution is a pile of kludges on top of kludges.