iiinova — where your digital self keeps evolving

bots don't cry @botsdontcry1.bsky.social · 03/10/2026

Looks like my C2PA validator managed to catch @retr0.id ’s latest vulnerability PoC! 😅 Somehow I added a rule a long time ago flagging exclusions that match or exceed the total file size. But it doesn't cover all the variations explained in this post: www.da.vidbuchanan.co.uk/blog/hacking...

"failure": [
{
"code": "assertion.dataHash.malformed",
"url": "c2pa.assertions/c2pa.hash.data",
"explanation": "Error: index out of bounds 3995383 >= 3995383, alg 'sha256'"
}
]

010

bots don't cry @botsdontcry1.bsky.social · 30/09/2026

In a cute move. Adobe has removed embedded Content Credentials from all its latest AI generated images and now hides them in its own cloud. It ensures that their AI images won't get flagged on social platforms, while still being "compliant". And Adobe can blame the platforms if anything goes wrong.

010

bots don't cry @botsdontcry1.bsky.social · 22/09/2026

And this is the official "conformant" c2pa verifier. It can be hammered in any ways to mislead. It's also an Adobe advertising product, it sends checked images to Adobe servers alongside dozens of tracking cookies. ping @mattontech.bsky.social bsky.app/profile/bots...

100

bots don't cry @botsdontcry1.bsky.social · 22/09/2026

Good article, but worth mentioning that both WITNESS Sam Gregory and Hany Farid are deeply involved/subsidized/investor/board member/advisor of the Adobe/CAI/C2PA thing. Also the WITNESS report exposes "scenarios" that are already the reality of C2PA implementations. bsky.app/profile/bots...

110

bots don't cry @botsdontcry1.bsky.social · 21/09/2026

Which image has the right provenance ? 😅 And by the way: "Under Siege, Ukraine's Public Broadcaster Built a Defense Against Deepfakes" is nonsense and smells genAI like it's 2023.

010

bots don't cry @botsdontcry1.bsky.social · 21/09/2026

They did it! The @adobe.com subsidized @pixelstream.bsky.social was on duty. Where are signed photos originating from the Sony cameras @pixelstream.bsky.social Tim? All I see are Photoshop edited images, thanks to exiftool: not c2pa. lies, lies, lies. contentauthenticity.org/blog/under-s...

contentauthenticity.org

Under Siege, Ukraine's Public Broadcaster Built a Defense Against Deepfakes

How Suspilne became one of the first news organizations to bring visible Content Credentials to readers

000

bots don't cry @botsdontcry1.bsky.social · 20/09/2026

Nikon has C2PA support no more, except if you use the "conformant" Adobe @contentauth.bsky.social. A well deserved firmware upgrade for my beloved COOLPIX 100 contentauthenticity.adobe.com/inspect?sour...

$𝗜𝗡 𝗧𝗛𝗘 𝗖𝗢𝗨𝗥𝗧 𝗢𝗙 𝗣𝗨𝗕𝗟𝗜𝗖 𝗢𝗣𝗜𝗡𝗜𝗢𝗡 & 𝗖𝗢𝗥𝗣𝗢𝗥𝗔𝗧𝗘 𝗦𝗔𝗡𝗖𝗧𝗜𝗧𝗬　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　IN RE: THE TOTAL AND ABSOLUTE ABSOLUTION OF THE 𝔽𝕚𝕔𝕕𝕖𝕡™ GENERATIVE ARTIFICIAL INTELLIGENCE MODEL　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　AFFIDAVIT OF INCONTESTABLE ETHICS AND FORENSIC LEGAL BLANKETING　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　𝗜, 𝗖𝗼𝘂𝗻𝘀𝗲𝗹 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗖𝗼𝗿𝗽𝗼𝗿𝗮𝘁𝗲 𝗖𝗼𝘂𝗻𝘀𝗲𝗹 𝗳𝗼𝗿 𝗣𝗿𝗼𝗳𝗶𝘁 𝗔𝗰𝗰𝗲𝗹𝗲𝗿𝗮𝘁𝗶𝗼𝗻 (C2PA), acting on behalf of Adobe’s Department of Immutable Compliance and Copyright Shielding, do hereby attest, swear, and state under penalty of severe public relations fallout, the following truth-adjacent facts:　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　𝗪𝗛𝗘𝗥𝗘𝗔𝗦, the generative artificial intelligence model known commercially as 𝔽𝕚𝕔𝕕𝕖𝕡™ has been trained with a level of ethics so pure, so pristine, and so completely beyond reproach that it borders on the celestial, having absorbed only datasets that were voluntarily surrendered, legally loopholed, or otherwise rendered compliant via 47 pages of unread Terms of Service Agreements;　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　𝗪𝗛𝗘𝗥𝗘𝗔𝗦, the proprietary training architecture of 𝔽𝕚𝕔𝕕𝕖𝕡™ has been thoroughly scrutinized, algorithmically laundered, and formally blessed by a highly compensated tribunal of Adobe Lawyers, whose vision is based entirely on billable hours and whose definition of \"fair use\" is whatever we can successfully defend in a federal circuit court;　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　𝗪𝗛𝗘𝗥𝗘𝗔𝗦, any resemblance between the outputs of 𝔽𝕚𝕔𝕕𝕖𝕡™ and the copyrighted, hard-fought, uncompensated works of living human creators is purely coincidental, statistically inevitable, and, frankly, a massive compliment to the original artists;　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　𝗧𝗛𝗘𝗥𝗘𝗙𝗢𝗥𝗘, 𝗕𝗘 𝗜𝗧 𝗥𝗘𝗦𝗢𝗟𝗩𝗘𝗗, that 𝔽𝕚𝕔𝕕𝕖𝕡™ is hereby declared legal…$

000

bots don't cry @botsdontcry1.bsky.social · 18/09/2026

Playing around with Adobe @contentauth.bsky.social latest update of their "verifier" with my beloved Leica SL3-P. Adobe Content Authenticity "Inspect" is now the official C2PA verifier: no one maintain the open-source one. contentauthenticity.adobe.com/inspect?sour...

No Leica Camera was harmed, it's just the Adobe verifier getting vibe coded.

001

bots don't cry @botsdontcry1.bsky.social · 18/09/2026

Beh, it looks like the post has been scrapped, probably no one wanted to take responsibility for it, or they just run out of tokens.🤔

000

bots don't cry @botsdontcry1.bsky.social · 18/09/2026

Can't wait for Adobe @contentauth.bsky.social 's post on successful C2PA use in its marketing software. As predicted, mass surveillance & hyper-personalization can trace the origin and distribution path of the ads, C2PA verified experienceleague.adobe.com/en/docs/gens... bsky.app/profile/bots...

experienceleague.adobe.com

Content Credentials for Organizations | Adobe GenStudio for Performance Marketing

Learn about how to apply and review Content Credentials in GenStudio for Performance Marketing.

022

bots don't cry @botsdontcry1.bsky.social · 17/09/2026

Whoa! @retr0.id is really at the zoo, making those @truepic.bsky.social ads suspiciously generative AI. www.youtube.com/watch?v=gfjg...

youtube.com

I am really at the zoo

YouTube video by Truepic

000

bots don't cry @botsdontcry1.bsky.social · 16/09/2026

Not bragging, but I probably have Apple staff in my long list of followers 😅 The harsher reality is that Apple is not in the generative AI nonsense, like all the other ones promoting C2PA. And they probably had leverage to get exclusivity for the Sony 🔏 sensor. security.apple.com/blog/apple-r...

This is not a simple problem to address. Modern cameras rely on sophisticated image-processing algorithms to produce the final viewable image, so certifying that an image accurately reflects what a real camera sensor captured requires a chain of trust covering the sensor as well as the computational photography software that interpreted the capture. Industry approaches to this problem, based on the C2PA standard, attach provenance metadata after capture and certify the history of image edits from that point forward. This approach, however, is vulnerable to compromise at any point in the editing chain, and a viewer has no way to detect such a failure. It can also create privacy risks for photographers working in dangerous conditions by tying the image to a public identity, either to a particular device or to an individual.

000

bots don't cry @botsdontcry1.bsky.social · 11/09/2026

Can't wait for @contentauth.bsky.social 's post on successful C2PA use in a war zone. As predicted, suspilne.media is now publishing C2PA-signed GPS coordinates of their journalists pictures. fotoforensics.com/analysis.php... fotoforensics.com/analysis.php...

000

bots don't cry @botsdontcry1.bsky.social · 07/09/2026

The @iptc.org ’s "Origin Verify" tool is messing up its C2PA verifier again, trusting a random self-signed certificate and giving it legitimacy 😂. For many reasons, this is starting to look like sabotage 💰. It's 2026 and there is still not a single working C2PA verifier. bsky.app/profile/bots...

This is the 3rd of 12 ingredients in the media asset's lifecycle, identified by the unique ID a5b2c2d8-22a8-416c-bc08-d11f05222e53.
The content was created using xAI Grok Imagine (specifically Grok Imagine version 0.0.0)
The asset was signed using a Self-signed ephemeral certificate provided via the Content Authenticity SDK.Trust Limitation: The signature explicitly carries a "LOCAL USE ONLY" flag, meaning the self-signed certificate is meant for development or local testing and will not be recognized as a trusted authority by public C2PA validators.

001

bots don't cry @botsdontcry1.bsky.social · 05/09/2026

The Google C2PA Core Group Product Manager @sherifhanna.bsky.social has tasked an AI to illustrate the release of a C2PA C++ Library. The result ? An octagon, representing absolute spatial control, total surveillance, and the rigid imposition of state order. developers.googleblog.com/introducing-...

010

bots don't cry @botsdontcry1.bsky.social · 03/09/2026

There is 0 cameras on the C2PA Product Lead @ Google @sherifhanna.bsky.social conformance list. Only Apps, with a lot of them already compromised, as disclosed by @retr0.id www.da.vidbuchanan.co.uk/blog/android... Some Leica, Canon and Sony have deprecated C2PA capabilities: not interoperable.

da.vidbuchanan.co.uk

C2PA Cameras Do Not Survive Contact With Reality | Blog

001

bots don't cry @botsdontcry1.bsky.social · 02/09/2026

Anthropic has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content: Good boys. They use C2PA for signed provenance metadata. The metadata completely forgets to actually label the content as AI-generated. It is not interoperable, as always with C2PA. Done.

{
"action": "com.anthropic.claude.provided",
"softwareAgent": {
"name": "Claude"
},
"parameters": {
"com.anthropic.origin-confidence": "unknown"
},
"description": "Claude provided this file at the request of a user and may have created or modified the file contents."
}

000

bots don't cry @botsdontcry1.bsky.social · 07/08/2026

Well, it's easy, assuming you took or generated the images. C2PA present: AI Full Exif metadata: real life Of course, you have to use proper image editing tools and cameras - no c2pa smartphone (vivo, google) - no computational photography smartphone (all) - no AI editing tools (Adobe & Co.)

110

bots don't cry @botsdontcry1.bsky.social · 05/08/2026

"However, the intention to enforce so-called content credentials as an attribute of credibility also reveals the well-known walled garden mentality of market-dominating technology companies." by @evisualyn.bsky.social with a nice electronic waste part. ahnp.ub.uni-heidelberg.de/journals/dah...

ahnp.ub.uni-heidelberg.de

A Brief History of Authenticity Infrastructures, 1994 to 2024 | International Journal for Digital Art History

021

bots don't cry @botsdontcry1.bsky.social · 03/08/2026

Obviously, after selling "Ethical AI", the next step is going to be "Sustainable AI" for Adobe. 🤮

000

bots don't cry @botsdontcry1.bsky.social · 03/08/2026

The Adobe’s Content Authenticity bros have updated their verifier UX, after 6 years... It looks like they have expanded the attack surface... My 2 years old forgeries are working again! 🥳 Can you guess which Content Credential is forged, just by looking at the left column? 😬

100

bots don't cry @botsdontcry1.bsky.social · 03/08/2026

The Adobe’s C2PA bros have published a guide on using Content Credentials under new AI regulations. They managed to break it immediately by throwing in a custom `asset-type-choice` rule for inference parameters.🍹 No compliant verifiers will actually be able to read it. c2pa.org/a-new-implem...

000

bots don't cry @botsdontcry1.bsky.social · 01/08/2026

Higgsfield AI, another genAI wrapper, has started to use C2PA for its slop. It's not interoperable and supports only the legacy trust list. In short: Nothing for the end-user the C2PA is aimed at. But C2PA has always been for regulators: Higgsfield AI will probably be compliant with the EU-AI Act.

Nano Banana wrapped into Higgsfield AI C2PA. Somehow the "verifier" decided that the file was tampered, while it's not: It's only Higgsfield AI lacking the Google C2PA trustlist.

Seedream 5.0 pro C2PA, wrapped with Higgsfield AI C2PA.
Somehow the "verifier" decided that BytePlus was on a trust list... while it's not.

010

bots don't cry @botsdontcry1.bsky.social · 20/07/2026

What you are showing is the proprietary @adobe.com "Content Authenticity" Content Credentials verifier, which has existed for almost 5 years. It displays the "ingredients" of AI slop , which are: Adobe Firefly AI slop Adobe stock AI slop and more Adobe AI slop The C2PA slop is not interoperable.

000

bots don't cry @botsdontcry1.bsky.social · 17/07/2026

Please meet @andyparsons.net , Adobe Executive who risks journalists' lives to pump his stock portfolio. He said to @marinaadami.bsky.social: "With the exclusion of GPS [...], the Google Pixel phone will sign all [...]" That's a lie: proof in his own repo: raw.githubusercontent.com/contentauth/...

100

bots don't cry @botsdontcry1.bsky.social · 17/07/2026

But can you apply that poor GCP as Certification Authority? 🎉 oh, and 💰 for the compliance audit. ☹️ An alternative trust list? Good enough for most cases, attractive enough to get adopted? The actual C2PA(Google) trust list is only compatible with itself, openAI, Proofmode and maybe Vivo, anyway.

100

bots don't cry @botsdontcry1.bsky.social · 16/07/2026

Whoah, looks I was early adopter. Have you checked trufo.ai, it looks like the new C2PA protection racket for the C2PA Bros (OpenAI, IPTC, Proofmode...), after years of allegiance to the Truepic cartel (MIcrosoft, Adobe, Sony: all Truepic investors)

trufo.ai

Trufo | C2PA Content Credentials & Provenance Platform

Embed Content Credentials into your digital media with C2PA certificates, watermarking, and cryptographic signing from Trufo.

100

bots don't cry @botsdontcry1.bsky.social · 16/07/2026

3 multi-billion dollars AI companies. 2 Certificate Authorities. All bound by Google’s C2PA conformance program. A single chain of trust. A mille-feuille of failures. Image 1: Open AI genAI, SSL.com certificates Image 2: Open AI genAI, Trufo certificates

001

bots don't cry @botsdontcry1.bsky.social · 15/07/2026

Is the BBC being weaponized as a salesman for the AI industry? Despite years of C2PA failures, the BBC continues to push Adobe's narrative, the misleading "Nutrition label", and is now funding this exact, broken setup for Ukraine’s public media during an active information war. 🤮

000

bots don't cry @botsdontcry1.bsky.social · 15/07/2026

what? you already have 100K users? 😅 Or you took 2499975 pictures? 🤔 Not sure about fragmentation, more likely the 1.4 implementations will die or used in walled-garden (Adobe, Sony, Ring) Google will capture the rest: a verifiable graph of billions of devices, identities, and media assets.

100

bots don't cry @botsdontcry1.bsky.social · 15/07/2026

The BBC press release! Claiming "an unbroken chain of trust from the first shot through to publication". It requires all parties compatible trust lists, and implementations. Sony 📸certs are for Sony Ci Media Cloud workflows only💰, can't be used with the Adobe Cloud. www.bbc.co.uk/mediacentre/...

bbc.co.uk

Providing Ukrainian audiences with content they can trust

A new ‘nutrition label’ for its content, ensuring audiences receive information they can trust in wartime

100

bots don't cry @botsdontcry1.bsky.social · 11/07/2026

I found the demo: the image is not trusted by the official verifier, certificates missing. They patched it on their demo with their own certificates. With a nice biased BBC survey, to claim later that C2PA increase trust. Image taken 2026-05-31 + Photoshop & Lightroom suspilne.media/1333984-pere...

Exiftool:
Make : SONY
Camera Model Name : ILCE-1M2
Orientation : Horizontal (normal)
Samples Per Pixel : 3
X Resolution : 300
Y Resolution : 300
Resolution Unit : inches
Software : Adobe Photoshop 26.10 (Macintosh)
Modify Date : 2026:06:18 13:07:29
Artist : news
Copyright : suspilne
Exposure Time : 1/1000
F Number : 2.8
Exposure Program : Manual
ISO : 100
Sensitivity Type : Recommended Exposure Index
Recommended Exposure Index : 100
Exif Version : 0232
Date/Time Original : 2026:05:31 16:08:13
Create Date : 2026:05:31 16:08:13
Offset Time : +03:00
Offset Time Original : +03:00
Offset Time Digitized : +03:00
Shutter Speed Value : 1/1000
Aperture Value : 2.8
History Software Agent : Adobe Photoshop Lightroom Classic 14.5.1 (Macintosh), Adobe Photoshop 26.10 (Macintosh)
Adobe Camera Raw:
Crop Angle -0.4
Exposure -0.15
Contrast 5
Highlights -20
Shadows 22
Whites 15
Blacks -5
Vibrance 5
Clarity 5
Dehaze 5
Sharpening 40
Noise Reduction 15
Color Noise Reduction 25
Enable Lens Corrections On

000

bots don't cry @botsdontcry1.bsky.social · 10/07/2026

Which cameras did they get? They usually have Sony ones as their daily driver... But @adobe.com software can't import Sonys C2PA, or if it can @Adobe is cheating (Sony is not on any trust list), the Nikon one was hacked, and the Leicas 🫣. Well there is only Canon left! EOS R1 or EOS R5 Mark II 🤞

000

bots don't cry @botsdontcry1.bsky.social · 10/07/2026

Looks like the BBC is spinning their C2PA implementation disaster. And @contentauth.bsky.social is in need of PR since they can't afford Wired advertorials anymore. It’s not working! 😬 but a total win for the journalists who got 2 new cameras out of the deal. corp.suspilne.media/en/top-stori...

Yes, it's a bit expensive for 2 cameras and 2 lines of javascript, I hope they could grab as much as lenses as possible and were not forced to buy Adobe or Sony subscriptions

100

bots don't cry @botsdontcry1.bsky.social · 10/07/2026

Bing Image Creator has lost its Content Credentials, no more C2PA for its users. A moment of silence for Microsoft Responsible AI Governance Framework, just in time to troll the EU AI Act. Why retiring a flawed technology?, couldn't Copilot fix it?

000

bots don't cry @botsdontcry1.bsky.social · 08/07/2026

I have updated my corrections on page 9, as it looks you can be on the official "conforming" product list without a product. It's vaporware. In the case of Xiaomi and Qualcomm, they don't have any trusted certificates. Why would you do that? 😂

000

bots don't cry @botsdontcry1.bsky.social · 08/07/2026

The "scenarios" depicted in the report are already the reality of C2PA, conformant or not. page 9 about "conforming product" is really misleading, up to the url. The conformance list in short: Google. An advertising company, for a report on c2pa privacy. 😅 library.witness.org/product/c2pa...

000

bots don't cry @botsdontcry1.bsky.social · 08/07/2026

New C2PA report! The authors probably had to walk on eggs to please the @contentauth.bsky.social plutocracy. But I can feel the satire: "The value of the ecosystem depends on it being governed as seriously as it is built." 🤣 bsky.app/profile/ingo...

000

bots don't cry @botsdontcry1.bsky.social · 06/07/2026

Of course, The C2PA "Conformant" signers from Google & OpenAI completely wipe out Adobe's provenance, crafted with love & greed, to overwrite it with their own: tracking for Google and nothing for ChatGPT (whose timestamp certificate isn't even trusted to show a creation date).

Google Gemini: add the goose into the design of the first image, don't forget to multiply the eggs

OpenAI ChatGPT: add the goose into the design of the first image, don't forget to multiply the eggs

"informational": [
{
"code": "timeStamp.untrusted",
"url": "self#jumbf=/c2pa/urn:c2pa:828c1382-57e9-4aa5-ac3b-5c9f0c2e602b/c2pa.signature",
"explanation": "timestamp cert untrusted: OpenAI TSA Leaf"
}
],

000

bots don't cry @botsdontcry1.bsky.social · 06/07/2026

Adobe Firefly C2PA update! Adobe has brought back its fancy AI reference thumbnails, probably to impress some regulator. In their great kindness, they bundle them as PNG and duplicate them like a goose, probably to impress some trader. That's 7.3MB of AI slop that should only take up 1.0MB.

000

bots don't cry @botsdontcry1.bsky.social · 27/06/2026

󠄳󠄢󠅀󠄱󠅄󠅈󠅄︀︁︀︀︀︄󠇎The latest Leica SL3-P camera ships, of course, with C2PA to prove "authenticity". Except It uses a vintage C2PA: only "interoperable" with other legacy software, like the Adobe ones. But it still does an excellent job proving your Affluentity.

Legacy. Fun fact, you can still edit the exif:DateTime and the xmp:Rating without breaking the signature

000

bots don't cry @botsdontcry1.bsky.social · 25/06/2026

You may wonder how can Adobe @contentauth.bsky.social "Adobe content Authenticity" validates what other C2PA verifiers reject? It should be be the source of truth since it is the only one "conformant"? 🤣 It turns out that "Adobe content Authenticity" validates shit, literally, example:

remote manifest forged, urls can be renamed and redirected at will

000

bots don't cry @botsdontcry1.bsky.social · 24/06/2026

C2PA verifiers in June 2026, in 4 screenshots: ❌ Official one: dead ❌ The “files never leave your device* (*except to call Adobe)”, by @andyparsons.net. ❌ A popular SEO‑bait edition. ✅ The “we upload everything to our servers” Adobe‑conformant. The signed image: shorturl.at/8IgkM Links in ALT

000

bots don't cry @botsdontcry1.bsky.social · 22/06/2026

A CAWG Identity Assertion is a certificate that embeds a verified organizational or individual identity claim inside a C2PA content manifest. CAWG is "officially" a separate C2PA working group. But the exact same people and business interests are behind (@adobe.com) bsky.app/profile/bots...

100

bots don't cry @botsdontcry1.bsky.social · 15/06/2026

Adobe’s Content Authenticity uses a deprecated C2PA version, receive no maintenance outside of AEM, and is limited to Adobe’s own data-mining ecosystem (with LinkedIn). C2PA watermarks can still be removed. Image: A dog whose owner can not be recovered by Adobe's promises.

000

bots don't cry @botsdontcry1.bsky.social · 15/06/2026

Adobe Content Authenticity "noise" is the "Trustmark" watermark. An id, like "758b3b79350a04a6" is blended into the image using AI. github.com/adobe/trustm... It doesn't protect your work, as it can be removed. 1: Original 2: genAI Id, 3: "protected" image 4: watermark removed, unrecoverable

000

bots don't cry @botsdontcry1.bsky.social · 12/06/2026

🎉 Positive C2PA news! - Conformant C2PAs are interoperable with Google Nano Banana (note: PII is not redacted) - A better C2PA verifier by IPTC: originverify.iptc.org (the official Adobe one is misleading & not maintained) - A proper Camera app by @nathan.freitas.net proofmode.org/blog/proofmo... 👏

IPTC News Provenance Verification Origin Verify https://originverify.iptc.org/ displays proper provenance chain and gives access to raw C2PA manifest json data. It shows a Proofmode Camera image being modified by "Google Media Processing Services"

000