I created an NFT, but the image renders differently based on who's looking at it.

For example, on OpenSea: opensea.io/assets/0x5c61a…

...vs on Rarible: rarible.com/token/0x5c61af…

...vs if you own it, it currently renders as a large 💩 emoji in your wallet. How this works:

NFT image data is not on-chain (too costly). Instead, what's on-chain is just a URL that *points* to the image. But surprisingly, there is no hash commitment in the NFT for the image at the URL. This means whoever controls the URL host can change the NFT image at any time.

Looking at popular NFTs, there are tokens trading for crazy $$ where the NFT image comes from a random VPS running Apache. The VPS admin, or anyone who controls the domain name, can change the NFT image/name to render as 💩 (or whatever) at any point w/o owning the token.

My NFT simply does this by default. It renders differently based on the IP/UA of the request, so the NFT image data isn't ever consistent, and what you bid on isn't what you get. This is how ERC721 is setup, though, not something unique to this NFT

Good luck to all bidders!


• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Moxie Marlinspike

Moxie Marlinspike Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @moxie

9 Jul 20
I've had a bunch of discussions with people here about Signal PINs over the past day.

I don't usually spend this much time on Twitter, so parallel to the direct discussion, these are a few of the adjacent thoughts that have come up for me:

1) I think it's increasingly important to consider how discussions around technology are perceived across the full spectrum of backgrounds (from technical to non-technical) for everyone interested in the topic of their own privacy/security -- which is basically everyone now!
Its interesting that some folks who see discussion around PINs conclude "switch to app X!" where X invisibly stores the same data in plaintext rather than e2e.

Signal's efforts are a discussion b/c we're designing not to store data in plaintext, while plaintext got no discussion
Read 14 tweets
2 May 20
Many trends in modern programming language design seem to focus on developers pressing fewer keys on the keyboard. To me, that's a strange priority.

For large systems where the industry spends most of its time, I think "readability" is much more important than "writability."
For example, even simple features like "type inference" feel like misplaced priorities to me.

People say "it's annoying I have to write String foo = new String()," but realistically, you're more often writing "String foo = bar.getBaz()"

If that becomes "val foo = bar.getBaz()"
...what is "foo?"

"The compiler can figure it out!" they say. But what I care about is whether someone looking at the code can figure it out.

We're writing 3 fewer characters one time, at the cost of less information for the ~years people will have to read and understand it.
Read 5 tweets
10 Apr 20
First look at Apple/Google contact tracing framework:

1) Once a day, your device derives a new key ("daily tracing key").

2) It uses that to derive a new "proximity ID" every time your device's bluetooth address changes (15min), which is broadcast to nearby BT sensors.

3) Your device keeps track of all "proximity IDs" it sees.

4) If someone tests positive, they choose to publish their (previously secretly) "daily tracing keys."

5) Your device frequently DLs all published daily tracing keys and KDFs to see if they match recorded proximity IDs.
So first obvious caveat is that this is "private" (or at least not worse than BTLE), *until* the moment you test positive.

At that point all of your BTLE mac addrs over the previous period become linkable. Why do they change to begin with? Because tracking is already a problem.
Read 10 tweets
30 May 19
When I think about why tech often fails to serve our interests, I think about rooms like this. So long as software requires large rooms of people staring at computers all day, every day, forever -- I think there will often be a mismatch b/t how we wish tech worked and how it does
Many hope to make technology serve us better by making it "distributed." I (controversially) don't think that would be the outcome, in part because distributed systems are usually *more* complex and difficult to reason about, potentially requiring even larger rooms than this one.
Like what if there were Uber, but "decentralized?" Maybe then all the money can go to the drivers instead? Okay, but so long as that requires huge rooms of people sitting in front of a computer 8hrs a day, every day, forever -- I don't think that version will be any different.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!