C2PA Content Credentials Sign Media Provenance but Cannot Verify Scene Reality

·1 views

The Coalition for Content Provenance and Authenticity (C2PA), founded by Adobe, Microsoft, the BBC, Intel, and Sony, has developed a standard called Content Credentials that attaches a cryptographically signed history to image, video, and audio files. The manifest records the origin device, edits applied, and each step's hash of pixel data, allowing verifiers to detect tampering if the chain is broken. However, the standard only confirms what a device or tool recorded about its own actions — it cannot verify whether the scene itself was real, staged, or synthetically generated before capture. Bad actors can strip manifests entirely or omit assertions, and since many platforms and tools drop metadata without adversarial intent, the absence of Content Credentials carries little meaningful signal. Experts caution that C2PA is a narrow, useful provenance tool rather than a broad solution to media authenticity or AI-generated content detection.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

monkeypatch vs mock.patch: One rule to pick the right Python test tool

In Python testing, both monkeypatch and mock.patch replace attributes and clean up after tests, but choosing between them often comes down to a single question. If a test only needs a function to return a value or be suppressed, monkeypatch is the simpler choice, reading as plain Python with built-in cleanup for environment variables, directories, and sys.path. If a test needs to verify how a function was called — such as checking arguments with assert_called_once_with — MagicMock via mock.patch is the appropriate tool. The two can also be combined, using monkeypatch.setattr to install a MagicMock object, which avoids nested context managers while retaining full assertion capabilities. A key rule for both approaches is to patch where the name is looked up in the module under test, not where it was originally defined.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a Green CI Pipeline Does Not Mean Your Release Is Safe

A passing CI pipeline only confirms that the specific checks configured have passed under controlled conditions, not that a release is production-ready. Code can clear every unit and integration test yet still fail in production due to mismatched environment variables, missing secrets, or incorrect feature flag states. Database migrations present a particular risk, as tests run against clean environments cannot replicate years of real production data, legacy records, or live traffic patterns. Modern applications also depend on external services and versioned APIs that CI cannot fully observe, meaning dependency-related failures may go undetected until deployment. Experts argue that release readiness is a broader operational concern, and treating a green pipeline as a final safety verdict is a common source of production incidents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Stripe Connect platforms silently absorb costs from lost payment disputes

When a payment dispute is lost on a Stripe Connect platform, the platform's balance is debited for both the disputed amount and a dispute fee of around $15, while the connected seller's account remains completely untouched. Unlike refunds, disputes are initiated by the cardholder's bank weeks after the transaction, leaving no automatic mechanism to reverse the original transfer to the seller. Platforms must manually trigger a transfer reversal via Stripe's API after a dispute closes, a step that is easy to overlook if webhook handlers only log the event without acting on it. The timing compounds the problem, as disputes typically close 30 to 90 days after the original charge, making the financial gap hard to spot in reconciliation reports. Platforms that have never reversed transfers on lost disputes may have unknowingly absorbed all such losses, and a targeted SQL query across dispute and transfer records can reveal the full unrecovered exposure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why S3 Is an Underused but Cost-Effective Disaster Recovery Asset

Amazon S3 and compatible object storage services offer a practical, low-cost foundation for disaster recovery, yet many organizations fail to fully leverage them despite already storing critical data there. According to Uptime Institute's 2022 Outage Analysis, over 60% of IT outages now cost at least $100,000, up from 39% in 2019, underscoring the financial stakes of inadequate DR planning. AWS S3 is designed for 99.999999999% durability by storing data redundantly across at least three availability zones, making it more resilient than most on-premises database setups by default. At approximately $0.023 per GB per month, storing 10 TB of DR backups on S3 costs around $236 monthly — significantly cheaper than maintaining a warm-standby database instance. Experts note that the most common DR failure is not storage breakdown but the absence of tested restore procedures, making regular restore drills as important as the storage strategy itself.

0 comments Read more at DEV Community