The problem is: publication is based on reputation. Reputation takes time and effort from the entire community.

I feel like modern infrastructure (Google Scholar, AI research, LinkedIn, etc) helped to decrease the importance of high-impact journals such as Nature, etc. Researchers don't rely on highly curated printed journals in their physical mailbox to get informed what's happening. You can just use tools to scrape content much faster.

But still: It can be career decisive if a reseachers lands a publication in a for-profit journal such as Nature.

The CS community has a much nicer publishing pipeline where most top journals/proceedings are attached to non-profit conferences and the fee is 0 (beside a conference fee).

I wish more fields would work like this: you publish with a conference proceeding and talk on the conference about your paper.

Researchers are themselves responsible for typesetting, advertising, etc. This and removing for-profit stakeholders can reduce the costs a lot.

Consider that this is a journal whose scope is defined not by field, but by funding initiatives. It places an astoundingly small emphasis on making research visible: contrasted with most major journals, with websites that might be split between research articles proper and editorial articles, but are still heavily focused on presenting articles, Open Research Europe doesn't have a single non-truncated article title on its front page, and devotes the vast majority of the page to journal administration and self-advertisement. The current lead highlight of PNAS is a section of rotating blurbs about articles, both research and editorial, for example. The current highlight of Open Research Europe is a description of Open Research Europe and logos of associated groups, including a second copy of the European Commission logo, in addition to the one on the top of the page. For that matter, the journal has a three-letter domain name, ore.eu, that it uses entirely to talk about itself, with only a single, small, text link to the journal itself. Why publish at a journal where your research seems to be far down their list of priorities?

With that said, I'm hopeful that CERN taking this over is a good sign. Zenodo is a great asset to the research community, and I feel like CERN is better situated to understand what will make a journal where researchers will want to publish. And I'd note, unlike Open Research Europe, Zenodo's front page is primarily a list of recent uploads, complete with partial abstracts.

>Researchers are themselves responsible for typesetting, advertising, etc. This and removing for-profit stakeholders can reduce the costs a lot.

That can depend on how the proceedings are published. Dagstuhl Publishing, for example, does do some typesetting and proofreading work for proceedings they publish, they just have it arranged in an extremely efficient way (everyone submits LaTeX using their class, so they're mostly fixing mistakes). They also do charge (an extremely small) publishing fee to the conference.

I've attended three international conferences in the past year. In each of them, there were plenty of people missing. People who would usually have attended but could not, due to issues that did not exist in the 2010s.

For me the solution is in signed e-mails and signed documents. If the person invites me to a online meeting with a signed e-mail, I trust that person that it's really them.

Same for footage of wars, etc. The journalist taking it basically signs the videos and verifies it's authenticity. It is AI generated, then we would loose trust in that person and wouldn't use their material anymore.

Ultimately ID requires either a government ID service, a third party corporate ID service, or some kind of open hybrid - which doesn't exist.

All of those have their issues.

These are valid approaches to the problem, but they are not necessary.

> or some kind of open hybrid - which doesn't exist.

PGP exists for decades. It doesn't have a great UX, it isn't used outside of its narrow niches, but it exists and does exactly this.

Can this problem be solved with better software?

I believe it can, it is just average person doesn't need PGP. No demand for software solving this problem, therefore no software for that.

The problem can be solved, like a storage for known PGP public keys with their history: like where the key was acquired, and a simple algo that calculated trust to the key as a probability of it being valid (or what adjective cryptographers would use in this case?).

You can start with PGP keys of people you know, getting them as QR codes offline, marking them as "high trust" and then pull from them keys stored at their devices (lowering their trust levels by the way). There are some issues how to calculate probability, because when we pull some keys from different sources we can't know are their reported trust levels are independent variables or not, but I believe you can deal with it, by pulling the whole chain of transfers of the key, starting from the owner of the key and ending at your device.

It is just a rough idea, how it can be made. Maybe other solutions are possible. My point is: the ugliness of PGP is a result of PGP was made by nerds and for the nerds. There is no demand for PGP-like solutions outside of nerd communities. But maybe LLM induced corrosion of trust will create demand?

The point of GP was that there any such system will require a central authority, PGP shows that you don't need it. I didn't claimed that PGP is a perfect or good enough solution, just that it exists and works for some people.

> both of you are honest and can be trusted to act in good faith when not in person

I believe it is not strictly necessary for the scheme to work. It is a limitation of OpenPGP and other implementations that they do not allow convert multiple independent observation of a public key (finding it from different sources, or encountering them used to sign messages) into a measure of trust to the key.

It is not a silver bullet either, but it can alleviate the problem and make it tractable.

The only doubts I have is how this system will stand against multiple actors trying to undermine it, but still I believe you can get something that will be better than nothing, and probably better than a central authority.

In the interview scenario, generating an email signature is hardly beyond what an AI can do.

You have no prior knowledge of this person or his signature, it's not some government issued ID, it's in essence just random data unless you know the person to be real.

With cash, you can only steal so much (or have transactions of up to certain size) until you run into geographical and physical constraints. With cryptocurrency, it’s possible to lose any amount.

With humans writing scam emails, you can only have so many of them until one blows the whistle. With LLMs, a single person can distribute an arbitrary amount.

At some point, quantity becomes a new quality, and drawing a parallel becomes disingenuous because the new quality has no precedent in human history.

And by that you mean tens of millions to billions right? Bank transfer scamming/fraud is a thing.

You are assuming that only you can generate fake AI videos of yourself.

The operating margin of Elsevier is around 40% which is huge! At the end mostly paid by tax-payer money.

Personally, I never review or publish with Elsevier.

https://gowers.wordpress.com/2012/01/21/elsevier-my-part-in-...

"Peer reviewed" as a binary concept might be as well, given that incentives have aligned to greatly reduce its filtering power.

They might both be examples of metrics that became useless as a result of incentives getting attached to them.

Right now Elsevier is by far the biggest offender and also happens to the be the topic of the conversation and the article.

(See Project DEAL: https://deal-konsortium.de/en/agreements/elsevier)

On the downside, I don’t see them yet taking ops seriously. They are getting a lot of attention, but not yet establishing SLAs (at least not publicly). And their donations don’t seem to be scaling to the continued and expected demand.

So yes, you use it to write the paper but soon it is public knowledge anyway.

I am not sure if there is much to learn from the draft of the authors.

Later at 6:45 they show more people testing them

That said, it wouldn’t surprise me if he does it all day long, 6 days per week.

If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk.

There is no way to store customer's secrets in a PC browser securely, so all the "dangerous" transactions were outright prohibited in the web app or made available only via temporary QR login.

All this is just is a negative side effect of customer protection laws.

There's no way to assess the security of a rom from an app and it's about time that banks learn this reality.

Software on mobile is even more fragmented and less standardized than on desktop

Now that's just not true now, is it? Sure the lawyers told you that (the ones that get paid to tell you that), but nowhere in EU was a bank actually fined for not root checking a device.

They were plenty fined by being utterly incompetent with security practices and doing them poorly - like trying to inject wierd .SOs to do the root detection you're defending.

"Payment service providers (PSPs) operating in the EU will have to cover customers’ losses from fraud if their fraud protection regimes are inadequate or poorly implemented under new EU rules."

Other places like the UK had such rules already.

The fact that no root lockout means "inadequate protection" is something you projected onto this statement and that's the part I'm addressing in my comment.

No one actually got fined for root protection specifically.

So sure, if you want to not use security tactics your competitors are using and then try to lawyer out of it by arguing, "it didn't specifically say we had to do that" in front of the EU Commission, go ahead. But don't blame the banks that are more realistic about how this works.

Which anyone of us who worked with banks, mobile, banking security and their legal already knew. They're a source of greatest security hits like "let's use SMS for only auth for web banking" after all.

But what's really hiding behind all your fluff is something else: Abusing users with root lockouts is EASY for the programmers at banks. The auditors have a checkbox "root lockout" and they tick the box. Legal ticks the box. CISO ticks the box. All happy, who cares about user. That's what this is all about. The insulting thing is trying to sell it like some kind of security feature.

If you really think this is all just fluff, by all means, go get yourself employed inside a bank's security team and convince them to turn all this stuff off. Let us know how it goes.

In some jurisdictions if bank can prove that transaction was made with customer's key then customer can not demand their money back. That's the best case, but there are only few of such jurisdictions and even there the burden of proof is on the bank and it costs a lot.

In other jurisdictions bank must reverse a transaction even if it was proven that the transaction was signed with a legitimate key, but the key _may_ have been stolen.

In some jurisdictions (i.e U.S.) banks are required to reverse a transaction at a customer’s request, even if the customer does not dispute having made the transaction.

In any case dealing with all this is too expensive and risky.

[Citation needed]

How much does it cost? How risky?

For many European banks the math is even more brutal.

Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.

For the past 20 or so years, every bank I've been with in Belgium has provided me with one of three types of hardware token:

1. An OTP token that's just a screen that displays a new 6 digit token every couple of seconds (haven't seen one of these in a few years now). This was used to supplement username/password on login and to verify every bank transfer.

2. A token with a screen and a display, which generates OTPs based on input. E.g. for a payment the bank would tell me to enter the amount + the last N digits of the bank account, the token then generates an OTP, which I can use to confirm the payment. That's what 2 of my 3 banks currently use. They have separate modes for logging in, for signing bank transfers, for signing 3D Secure online payments, etc.

3. A card reader where where I just slot in my card. I can then log in or sign payments using the card's chip & pin. This is what my third bank uses. There are a couple of variants on this, such as models which connect with USB and models which can read QR codes from your screen so you don't have to tap in anything except for your PIN.

The problem is the same, the relative concentration of oxygen in air is less than 0.05% (~450pars per million). In water much less.