Latest / Never Post / Doxxing Yourself For Science

Transcript

Doxxing Yourself For Science · Never Post

0:11
Mike Rugnetta: Friends, hello, and welcome to Never Post, a
0:14
podcast for and about the Internet. I'm your host, Mike
0:16
Rugnetta. This intro was written on Tuesday, 07/28/2026 at
0:21
08:34PM eastern, and we have a dangling show for you this week.
0:28
In this episode, I chat with security and privacy researchers
0:32
Jan Penekamp and Johannes Lomola about the legions of academics
0:38
potentially doxxing themselves in the process of publishing
0:43
their own research. It is a wild story of unforced errors,
0:48
unnecessary technological complexity, and platform
0:52
complacency.
0:53
But first, we're gonna take a quick break. You'll listen to
0:56
some ads unless you're on the member feed. And when we return,
1:00
we'll talk about a few of the things that have happened since
1:02
the last time you heard from us. Never Post, the show you're
1:08
listening to has some news and we're gonna put it right at the
1:11
top of the show so you don't miss it. First, we have released
1:14
oodles of new member content over the last couple weeks.
1:18
A team chat about party planning platforms with much part of full
1:23
slander and its own event invite. You heard about that on
1:26
the mailbag if you listen to it. We've released also a dramatic
1:30
reading by myself and Georgia of the legendary Tumblr post, Kurt
1:35
Cobain will have his revenge on the straights. And most
1:40
recently, we uploaded Paper Report, the first in an ongoing
1:44
series where we read and discuss published Internet research. It
1:48
is a blast.
1:49
Those uploads and more, including a slow post and a WIGO
1:53
from back in May, are all waiting for folks in the member
1:56
feed right now. Second, Member Drive stream week starts on
2:01
August 17 at 11AM eastern at twitch.tv/ the never post and it
2:09
will continue through the rest of the week. We have many of
2:12
your favorite guests from the extended Never Post universe and
2:15
more. Joining us throughout the week, got games and live segment
2:19
recordings, giveaways, and hopefully a bunch of new members
2:22
so we can keep making this show. A schedule and further details
2:25
will go out in two weeks, but as of right now, the week of August
2:30
17, clear your schedule, cancel your plans, call in sick to
2:33
work, and finally, we have a survey.
2:37
But here's the catch, we don't want you to fill it out. No. Not
2:42
you. Do not click that link. We would love it if your friends,
2:46
family, coworkers, folks who do not currently listen to the show
2:50
could fill it out.
2:51
We are working with some of the wonderful folks at Radiotopia to
2:54
do some audience development research and we wanna hear from
2:59
some folks who do not know what Never Post is except maybe in
3:04
passing because you won't stop talking to them about it. We
3:06
wanna know what they're into. What's their favorite color?
3:08
What's their ideal date? There's a link in the show notes.
3:11
Please text it to your mom, your favorite barista, and the
3:14
captain of your rival bowling league team. Thank you. Okay.
3:18
Time for the actual news. Jason, start the tunes.
3:24
Keep my feet on the ground, keep my head in the clouds,
3:28
electrified by the sound. It comes from the six stories this
3:33
week. HBO Max is launching shorts. Max shorts will
3:41
apparently consist of clipped segments of longer form
3:43
entertainment available on the streamer as well as trailers and
3:46
behind the scenes content according to a press release,
3:49
which also reads quote, the clips for this feature are
3:52
powered by an AI tool built in house which helps human editors
3:56
select and verticalize content by using machine learning
4:00
algorithms that utilize scene level metadata to comb through
4:04
thousands of hours of titles and suggest the most compelling high
4:07
impact scenes for discovery, end quote. If there's one thing I
4:11
love my content to be, it is verticalized.
4:16
This comes on the heels of similar products announced at
4:18
other streamers like Netflix, ESPN, Paramount Plus, and Disney
4:22
Plus, each of whom platforms like Instagram and TikTok as
4:25
direct competitors. A media consultant told Business Insider
4:29
in February that quote, premium streaming is plowing into this
4:33
space because of a need to own more lean back moments in a
4:37
viewer's day, end quote. This in my opinion represents a
4:41
fundamental misunderstanding of why audiences turn to short form
4:44
vertical video feeds, but maybe I'm wrong and all of you do want
4:48
to watch a hundred one minute clips of CBS's CSI Miami on
4:53
Paramount plus. France will be the first European country to
5:00
ban social media for teenagers. Their parliament recently
5:04
approved a law which will limit access to people under the age
5:07
of 15 starting at January 2027.
5:11
All social media users in the country will have to verify
5:14
their age when the law goes into effect. A process which we now
5:17
know from both Australia and The United Kingdom works perfectly
5:21
and without any hiccups or easy circumvention. A similar law has
5:25
been proposed though not passed in Vietnam. As currently
5:28
written, the draft law would apply to those under the age of
5:31
16 who would only be able to log on under parental supervision.
5:35
Vietnam would also require platforms to identify younger
5:38
users and moderate the content served accordingly.
5:43
Speaker 2: Let's dive into today's word. A French phrase
5:47
originating from the expression sacred god used to express
5:52
surprise or disbelief. Let's say it all together.
6:01
Mike Rugnetta: Your taxes are paying for Internet no one is
6:06
using in Alaska, if you're American at least. ProPublica
6:11
reports that thousands of abandoned homes on the nearly
6:14
empty Alaskan Adoc Island have an active obsolete Internet
6:19
connection which the United States government subsidizes at
6:22
the cost of $300,000 a year. Subsidies continue even after
6:28
service providers are sent to prison for tax evasion or end up
6:31
in court for fraud. What few residents remain on the island,
6:35
which is 1,200 miles off the coast of Anchorage, use Starlink
6:39
for internet access as it is both cheaper and more reliable.
6:43
Amongst Starlink's customers, the local internet utility
6:46
company.
6:53
Doom is our Moby Dick, says the Washington Post, which this
6:57
month named it one of the 25 most influential pieces of
7:00
American culture. Placed between thriller and the matrix on the
7:04
list, Wapo writes, Doom was foundational in digital
7:08
entertainment. A three d world viewed in first person, self
7:12
published with no gatekeepers and no retail store as it gave
7:16
rise to user generated content years before anyone had a name
7:20
for it. Programmer John Carmack handed the audience the tools to
7:24
build their own corners of hell, end quote. This comes not long
7:28
after Doom's soundtrack was inducted into the national
7:31
recording registry.
7:32
The shooter was also implicated in a trove of documents dumped
7:35
by the White House this month. Documents which purport to
7:39
reveal the dire state of the country's election security.
7:42
Amongst the examples of how easy it is to rig an election, a
7:46
tweet from Defcon twenty nineteen showing the screen of a
7:50
vote tabulating computer running doom. BitChat, the Bluetooth
7:57
based messaging app developed by former Twitter CEO Jack Dorsey
8:01
has been targeted by the Indian government for its role in the
8:05
ongoing Jantar Mantar student protests. The Indian Cybercrime
8:10
Coordination Center has demanded Microsoft remove the open source
8:14
publicly licensed software from GitHub as it allows protesters
8:18
to circumvent local internet blackouts implemented by the
8:22
government.
8:22
Quote, the application enables anonymous communication without
8:26
mandatory user registration, phone number verification, or
8:30
centralized logging of communications. The I c four
8:33
wrote, the technical architecture of the application
8:36
significantly impedes lawful interception, interception,
8:39
attribution, and investigation by law enforcement agencies, end
8:43
quote. The protests began alongside the CJP or cockroach
8:48
janta party, a satirical student led group formed online in
8:52
response to comments made by an Indian judge describing the
8:55
unemployed social media users and activists as quote,
8:59
parasites of society. There are youngsters like cockroaches, he
9:04
continued. Student groups have recently demanded transparency
9:07
and legal consequences around a number of national education
9:10
controversies, including the mismanagement of India's
9:13
national examinations.
9:15
The CJP began online, but its popularity quickly grew and
9:19
leaked into meatspace. Its organizers now regularly
9:22
communicate with the government and police. India's minister of
9:25
education Darmindra Pradhan recently resigned following
9:29
CJP's demands. To be eligible for membership, the CJP says one
9:33
must be unemployed by force, by choice, or by principle, lazy
9:38
referring only to physical activity, chronically online at
9:43
least eleven hours daily including bathroom breaks, and
9:46
have the ability to rant professionally. Content must be
9:51
sharp, honest, and point at something that matters.
9:54
You will find your destiny among the world's greatest warriors.
10:00
The few are the proud. And finally, social security numbers
10:08
in my physics research? It's more likely than you think. This
10:12
May at the forty seventh I triple e symposium on security
10:16
and privacy, five researchers revealed that a staggering
10:20
percentage of papers uploaded to the open access research archive
10:24
arxiv.org include what they call hidden secrets.
10:29
Some of these secrets may be mundane, things like comments,
10:32
template information, to do lists, and so on, but they also
10:36
found social security numbers, credit card info, home and work
10:40
addresses, gossip, and more. Archive is a massively popular
10:46
platform for serving academic preprints, papers which have not
10:50
yet been peer reviewed, and also industry white papers by
10:54
companies like Microsoft, Nvidia, Meta, and OpenAI. For
10:59
this paper, researchers focused on academic preprints
11:02
specifically and found a particular vulnerability in
11:05
LaTeX, a type setting system used to render among other
11:10
things math equations. 93% of submissions to archive use LaTeX
11:17
for which you are also required to upload the source files.
11:23
These source files often contain comments and other metadata that
11:28
authors never intended to publish.
11:31
Now there are programmatic methods to sanitize the files,
11:35
including methods recommended by archive itself, but many don't
11:39
work well or well enough. And once your paper is uploaded,
11:43
it's not so easy to take it down. We're gonna take a quick
11:48
break, and then I'm gonna talk to security researchers Jan
11:51
Penekamp and Johannes Lomola about the 2,700,000 research
11:56
papers that they analyzed, the thousands of hidden secrets that
12:01
they found amongst them, and why it's not so easy to get those
12:05
hidden secrets off of the archive once they're there.
12:20
Joining me are Jan Penekamp and Johannes Lomola. Jan Penekamp is
12:25
a postdoctoral researcher in computer science at the chair of
12:29
communication and distributed systems at RWTH Aachen
12:32
University.
12:33
Since 2023, he's been the head of Comsys' security and privacy
12:37
group, which analyzes and evaluates the security of
12:40
communication systems across the Internet of Things, healthcare,
12:44
and more. Jan, thank you for joining us.
12:47
Jan Pennekamp: Thanks for having me.
12:48
Mike Rugnetta: Johannes Lohmoller is a researcher at the
12:51
chair of communication and distributed systems at RWTH
12:54
Aachen University. He's a member of Comsys' security and privacy
12:58
group, where he researches privacy preserving methods,
13:01
particularly in the domain of health care. Johannes, thanks
13:04
for being here.
13:05
ohannes Lohmoller: Thanks for inviting me.
13:07
Mike Rugnetta: So, the two of you, along with three other
13:10
coauthors, submitted a paper in April that you then presented at
13:14
the twenty twenty six IEEE symposium on security and
13:18
privacy, in May. The paper is titled Hidden Secrets in the
13:22
Discovering, Analyzing, and Preventing Unintentional
13:27
Information Disclosure in Source Files of Scientific Preprints.
13:33
The paper details some, really interesting and slightly
13:37
shocking, security lapses, I guess you could say, in the
13:42
world of scientific publishing, and we're gonna get into, some
13:45
of the dramatic details in a moment. But I wanna start at
13:48
sort of first principles, if you don't mind. So for our audience
13:53
who might not be entirely familiar, could you just explain
13:57
what archive is?
14:00
And this is spelled a r x I v.
14:03
Jan Pennekamp: So archive is basically a way to circumvent
14:07
the traditional publishing processes. So in traditional
14:11
publishing, you have peer reviews and copy editing and so
14:14
forth and so forth. And this is often a costly time consuming
14:17
process while in contrast, archive which is a preprint
14:21
repository basically is something where you can submit
14:24
papers before peer review. So it also requires you to upload your
14:29
latest sources which are then translated in PDFs. Have and not
14:34
only do they require the latest sources for during submission,
14:38
but they also make them publicly accessible for each and
14:41
everybody basically to download without any registration,
14:45
without any checking whatsoever.
14:47
Yeah. So everybody can not only check out the PDF, but also the
14:50
search files of submitted papers.
14:53
Mike Rugnetta: And LaTeX is a big part of your findings in
14:57
this paper. Johannes, can you tell us a little bit about what
15:01
LaTeX is?
15:02
ohannes Lohmoller: It's basically the typesetting system
15:05
most of academia actually uses. So you don't just go to Word or
15:09
just to write down your paper manuscript, but you typeset it
15:14
in LaTeX, which enables, like, more fancy math. You can
15:18
integrate other sources as PDFs, so you get vector graphics and
15:22
all that kind of stuff. It's typically used for publishing
15:25
those papers.
15:26
Mike Rugnetta: And so what you found is not just that a
15:29
majority of papers, but most papers that had submitted
15:34
preprints to archive had unintentionally included what
15:39
you call secret information in various portions of the the
15:44
document?
15:45
ohannes Lohmoller: I would prefer calling it hidden
15:47
information in the first place, not necessarily secret because
15:51
how we defined is is that it's information that's somehow
15:55
contained in those source files that didn't end up in the
15:58
produced PDF.
16:00
Mike Rugnetta: What constitutes hidden information? What sorts
16:02
of things are you finding that someone should not want publicly
16:08
available?
16:09
ohannes Lohmoller: I think what I, for instance, wouldn't like
16:12
to see on the Internet on my papers is I mean, we often do
16:16
these to do items and things that we still have to address in
16:20
the papers and comments whether this is actually true or this
16:24
and that is missing a citation or this would need further
16:28
evaluation and analysis, conversations between authors in
16:32
the documents. I think for me, it feels like it's personal
16:36
information.
16:37
Mike Rugnetta: Sure.
16:37
ohannes Lohmoller: And then on the other end, we also found,
16:40
like, clear personal information, like names of study
16:43
participants that are not among the authors, but, well, like, of
16:48
the research. We also found credentials in their credit card
16:52
numbers, which was quite a surprise Wow. And things like
16:56
that.
16:56
Jan Pennekamp: And, obviously, this does not affect all of the
16:59
2,700,000 papers that we analyzed. But still, if you also
17:04
like 100 papers on there and you make, like, one mean remark
17:08
about a colleague or, I don't know, basically reveal, for
17:12
example, that you conduct scientific misconduct, those
17:16
kind of things. This can also be very damaging to your career,
17:20
reputation, and so forth. So, you know, it's just sufficient
17:23
to have this one bit of information there. Yeah.
17:25
Or alternatively, if you think about cyberstalking. Right? If
17:28
you leave leave your address in one of the papers, it doesn't
17:31
matter that it's that you have multiple papers on this website,
17:34
for example. Yeah. We also found sort of some remarks on the
17:39
Internet that indicate that also, like, these large LLM
17:43
providers may be scraping the source files files this way.
17:47
So they're not constraining themselves to the PDFs, but
17:50
actually also in the training data, those all this information
17:53
ends up there. And and and part of doing that, also the hidden
17:59
information that Johannes was just talking about is also
18:02
basically revealed or used by these companies.
18:04
Mike Rugnetta: So there is there is evidence that say, a bot
18:07
which is scouring the Internet for information related to an
18:12
LLM, like, say, potentially an OpenAI or an Anthropic is
18:17
gathering some of this hidden information. It whether or not
18:21
it makes its way into a model that then people have access to,
18:24
big question mark, but they've at least there's evidence that
18:27
they've accessed it.
18:28
Jan Pennekamp: Yes. To the best of our understanding. Yes.
18:30
Interesting.
18:30
Mike Rugnetta: I mean, does that mean that archive has to change
18:33
the way that it works?
18:35
Jan Pennekamp: I guess it's it's a matter of perspective again.
18:37
Right? If you consider disinformation to not be that
18:41
bad Sure. Then archive doesn't have to change anything because,
18:46
I mean, it's it's just conversational content on there.
18:49
Right?
18:50
We also reached out to them and basically they told us, like,
18:53
they do not consider this sort of information that we
18:56
discovered to be sensitive so that they need to act upon it.
19:00
So, basically, as they refrain from doing something, they told
19:03
us, alright. The authors are being made aware that this
19:06
information ends up there and we have clear reasons why we want
19:10
to include this information in the dataset or the repository,
19:15
basically. It's like if you go to Google and you don't like how
19:18
they display the search results,
19:20
Mike Rugnetta: well Sure.
19:20
Jan Pennekamp: Tough luck. You don't have to use the service,
19:22
but in the end, it's how they want to operate. Right?
19:26
Mike Rugnetta: And do they feel this way even knowing that, say
19:28
like, I'm looking at the list of some of the the things that you
19:31
found, things like Slack tokens, API keys, Facebook OAuths, and
19:37
they're like, yeah. That's fine. Like, if someone wanted to put
19:39
that up there, sure.
19:40
Jan Pennekamp: I mean, for those things, you can still revocate
19:43
the credentials in
19:44
ohannes Lohmoller: a way.
19:44
Mike Rugnetta: True. Yeah.
19:45
Jan Pennekamp: But, yeah, they they think it's the educator's
19:48
author's responsibility. Yeah. Mo multiple people, after
19:53
presenting the work or having it published multiple also reached
19:56
out to us and they asked like, why does archive even surface
20:00
content like these sources publicly? Like, they can just,
20:04
you know, keep them internally, and not share them. So this is
20:08
like the most common response that we're getting, I would say.
20:11
Mike Rugnetta: They don't have to serve the metadata that
20:13
reveals hold on. I'm looking at it here. Almost 4,000 United
20:18
States Social Security numbers.
20:19
ohannes Lohmoller: I mean, they argue it's for reproducibility,
20:22
and I think they had some point several years ago where authors
20:26
actually could upload ancillary data right into the submission.
20:30
So that's an actually intended way of, like, providing further
20:34
context or data and things like that next to the submission.
20:38
Uh-huh. But I think there are other large research data
20:42
repositories nowadays, like, say, Nodo, for instance, that
20:45
kind of fulfill the service. So I don't think it's, like,
20:49
necessary anymore to provide Lartic sources.
20:52
Mike Rugnetta: You also mentioned that there is a way
20:54
that this is a concern for the peer review process. Can you
20:59
just briefly describe why that might be?
21:02
Jan Pennekamp: In several disciplines, you do double blind
21:07
review, which basically means that the reviewer does not know
21:10
the author and the author does not know the reviewer. Now the
21:14
reviewer does not get disclosed because you submit sources, but
21:18
the author may get dis disclosed this way because you may not
21:22
only have anonymous authors in there but other things as well.
21:26
Similarly, if later on publishers collect the Lattice
21:29
sources, they basically have also the same amount of access
21:33
to the hidden information. Right? So while it is not
21:37
publicly accessible, it certainly is for those
21:40
publishing companies where you could say, right.
21:43
I'm trusting them, but, you know, security cyber incidents
21:46
happen across the board and depending on where where and how
21:49
much they store, yeah, malicious actors could still get access to
21:54
that after the fact. So it's it's also still crucial to
21:57
consider that angle in a way.
21:59
Mike Rugnetta: Right? Got it. And how is it that those things
22:03
that aren't needed for the final rendering end up being left in?
22:08
Is this just people don't know that they should remove them? Is
22:11
this a problem with the the software itself when you submit
22:15
the paper?
22:16
Jan Pennekamp: I think it's a little mix of all all things you
22:19
couldn't can think of. Yeah. So probably people are lazy. They
22:24
don't really care. Sometimes they don't even know that the
22:27
files end up being publicly accessible and they just upload
22:30
that.
22:32
Then archive actually lets you nowadays select whether files
22:36
are required or not, but only on on root level basically. So they
22:41
know about the issue. They sort of try to address it but I'm I'm
22:46
not sure how many people would actually select or deselect
22:50
stuff there.
22:51
Mike Rugnetta: Sure.
22:52
Jan Pennekamp: Yeah. And then for like if you have a big
22:55
project with hundreds of files, you can also just get lost and
22:59
not noticing that maybe you have 102 files in there. So it's
23:04
sometimes also just a matter of scale why why things are popping
23:08
up there.
23:08
Mike Rugnetta: Yeah. It's such a particularly and I think
23:12
uniquely specific example of all the ways that we leave data
23:18
trails behind us when we use the Internet and various platforms
23:22
on the Internet. And like, you know, not just the Internet,
23:26
guess, also just work you do with computers, you know, you
23:29
you end up leaving little bits of yourself and identifying
23:33
pieces of information about your life all around. And I think
23:36
like, there's all of these scenarios where we conceive of
23:41
information as private, or we think of files as being clean,
23:45
or not vectors for people learning sensitive things about
23:49
us. For maybe a bunch of, like, arbitrary reasons, we think that
23:53
things are safe, or maybe for no reason.
23:56
We just have haven't had a reason to consider otherwise.
24:00
But actually, like, those things are really public.
24:02
Jan Pennekamp: Yeah. I believe it's like if you think about
24:04
electric vehicles and kind of what information they record and
24:07
sometimes depending on which third party apps you're using,
24:10
maybe they also reveal stuff on the Internet. I mean, there are
24:14
these these apps for fitness tracking, right, where basically
24:19
your history is publicly available. So I think, you know,
24:22
it it comes up every year and now. And so this was basically
24:27
one of the occurrences where we as academia, people from
24:31
academia basically spot, something sensitive in a way.
24:35
Mike Rugnetta: Yeah. You talk about some of the ways that
24:37
exist for dealing with this issue because this isn't a new
24:41
problem. And in fact, archive basically recommends the use of
24:46
a a Google tool, I think it is, to sanitize the things that are
24:53
submitted. Could you talk a little bit about that tool and
24:56
others like it and why they're they aren't sufficient for
24:59
solving this problem?
25:00
Jan Pennekamp: So Lattice is a very powerful language. So you
25:03
have quite some diverse ways of inserting comments in there or
25:09
basically adding stuff that you do not need, in the final PDF.
25:15
And basically what we did is survey how prior solutions
25:20
basically work and what they did and most of them use regular
25:24
expressions to detect a comment and then act upon that. I would
25:28
say like the Google tool is actually ArchiveLatigleena that
25:31
is actually a quite mature tool but if you use some ways that
25:35
are not supported by this tool then, well, you're all of luck
25:39
and this information basically remains in there. And we argue
25:44
that it's not sufficient to rely on any of those.
25:47
And what's what strike us as interesting, none of them
25:50
actually consider this metadata level, even though, you know,
25:54
it's quite well known that metadata actually leaks or can
25:58
leak sensitive information.
25:59
ohannes Lohmoller: Now we were sitting on these 2,700,000
26:02
submissions and had this archive Latest Kiena tool floating
26:05
around. So we just, like, sew it on all of those submissions and
26:09
kind of figured out what happens. And then we found out
26:13
that, like, I don't know, nine above 90% have modified sources
26:18
after applying the tool. So we're not quite sure whether the
26:22
tool is more major nowadays or whether it was never applied to
26:25
the sources, But we kind of had an empirical way of figuring
26:29
out, like, how much additional content those tools would I
26:34
could remove from the submission.
26:35
Jan Pennekamp: It would not probably remove all the data
26:37
that we discovered, but it would already remove quite a lot by
26:41
margin.
26:42
Mike Rugnetta: And did you you developed your own tool in order
26:46
to sanitize submissions. Is that true?
26:48
Jan Pennekamp: Yes. So we were fortunate enough that one of our
26:52
co authors, a student that we supervised, that he came across
26:56
a different way of basically working with these LATHE files.
27:00
So instead of using regular expressions, he discovered
27:04
TreeSitter which basically is an abstract grammar that sort of
27:09
better reads or processes the LATH files. We're not saying
27:13
that our tool is perfect in any way. It's just, let's say, the
27:18
next step forward and showing, like, where there's potential
27:22
and how to to make the best out of an unfortunate situation, I
27:25
would say.
27:26
Yeah. Also, sort of looking in the future to enable many many
27:30
different authors and researchers, not only in
27:33
computer science, but basically, yeah, across all the disciplines
27:37
to apply that. And that's also why we sort of focused on really
27:41
reliability. So we wanted to make sure if you apply our tool
27:45
that then the information gets reliably removed and that it can
27:49
be sure that sort of the content is retained as it was so that
27:55
we're not over removing stuff. So, basically, altering the PDF
27:58
because we found, several cases where the Google tool over
28:03
removes content.
28:04
So in a way, you use your tool and then your the content that
28:07
you have in the paper is not identical anymore. And
28:10
unfortunately, you may not notice unless you check really
28:13
character basically in your paper. Now this is something
28:16
that can be quite damaging. Right? If you have a proof on
28:19
there and then for some reason there are like a couple of
28:22
characters missing in there or a mass formula and you you don't
28:25
know why that that doesn't work.
28:27
It doesn't make sense. It's just not equal anymore. So, you know,
28:30
it it also has an impact on sort of the scientific discourse and
28:34
it's, yeah, in general.
28:36
Mike Rugnetta: Yeah. Do you think the archive is gonna
28:39
switch their recommendation from the Google tool to yours?
28:42
Jan Pennekamp: I mean, we're not Google, so I I mean, I I don't
28:45
know. Let's see. If it gains sufficient traction, maybe.
28:49
Mike Rugnetta: So I'm curious what what do you think should
28:52
happen next and what in theory actually happens next? You
28:55
mentioned that, you know, archive has been pretty clear
28:59
that, like, they they think this is the system working, except in
29:03
extenuating circumstances where the information is very personal
29:07
or, you know, very important that it not be made publicly. So
29:10
it sounds like, you know, them changing the way that their
29:14
service works is remote. Is there now, like, an education
29:19
campaign that has to be undertaken in order to let
29:22
authors know that when they're submitting things, this is
29:24
something that they have to be thinking about?
29:26
Jan Pennekamp: Yes. Certainly. So I think, like, policy wise or
29:30
institutional guidelines on on how to work with archive is
29:33
something that's essential. So nobody ever, like, really told
29:37
me, like, how to work with archive. Right?
29:40
So at some point, it just came up and you're like, alright. I'm
29:43
just submitting my, first paper to archive. What can go wrong?
29:46
Right? But now that we know, like, a lot of things can go
29:50
wrong and, actually, you can't undo all of the things that can
29:52
go wrong.
29:53
So I I could imagine that funding agencies who basically
29:57
mandate that papers are getting open access publishing also have
30:02
sort of guidelines on on what they want to see up on archive
30:05
and whatnot. Yeah. And similarly, the institutions
30:09
themselves maybe want to be sure that authors do not basically
30:13
reveal damaging information. Right? They also have a
30:17
reputational desire to basically improve that situation.
30:22
If if they were were to come up with that, I mean, most of the
30:26
major universities have some kind of library service that
30:29
handle all those things. So I think, certainly, the the staff
30:33
and the way to implement those is there. It just hasn't been
30:38
done yet. Right? So getting that on track, I think this is very
30:42
crucial.
30:43
And it is also something that would not only help, like,
30:47
educated computer science or computer security researchers,
30:51
but, basically, help people across all the disciplines
30:54
because then you have guidelines, something to
30:55
follow-up on. And even if it just says, you know, be careful.
31:00
You like, use caution, maybe reach out to an expert, somebody
31:03
who supports you on basically submitting that, that would be
31:07
something to to really go a long way with this.
31:09
ohannes Lohmoller: I think we should make this a shared
31:11
responsibility between authors and publishers because even if
31:15
we get the tooling and the awareness right, at least the
31:19
time issues, so deadline, pressure, and so remains. And
31:24
since we have seen at least some of those aspects could be easy
31:27
easily fixable on archive sites, I wouldn't just, like, redeem or
31:33
exempt the authors from their responsibility, but something
31:37
could also be done at the publisher's side.
31:39
Jan Pennekamp: In the end, it's a community effort to basically
31:42
improve everything.
31:43
Mike Rugnetta: Yeah. Jan, Johannes, thank you so much for
31:48
joining us. I really appreciate you taking the time out of your
31:50
important and busy schedules to chat with me.
31:52
ohannes Lohmoller: Thanks for having us.
31:53
Jan Pennekamp: It was a pleasure being here.
31:55
Mike Rugnetta: What is the best place for folks to go to be able
31:57
to keep tabs on what you're up to?
31:59
Jan Pennekamp: This paper is already up on archive naturally,
32:02
including sources. K. So you can also look around what we did in
32:06
there.
32:07
Mike Rugnetta: Including including, I assume, your credit
32:09
card number and home address.
32:10
Jan Pennekamp: Sure. You you can take a look if you find it and
32:12
then let me know. I I will look at my bank statement to see. And
32:18
we do also host a website, which is archive.com. It's
32:23
.rwth-ahn.de, quite a long name, which basically gives you an
32:28
executive summary and so any updates that probably would
32:32
follow after this work, we would also host there.
32:34
So this really gives you a high level overview about the key
32:37
findings that we have.
32:39
Mike Rugnetta: Thanks again to Jan and Johannes. If you would
32:42
like to read their paper or see more work from them or their
32:45
department, you can check the links in the show notes. That is
33:09
the news we have for you this week. We are gonna be back here
33:11
in the main feed on or around Thursday, August 6. In a couple
33:15
short weeks, the Never Post Member Drive stream week will
33:18
begin during which we will endeavor to add to the ranks of
33:21
wonderful people who support this show, help keep it running,
33:25
and maybe most importantly, it get better and weirder and more
33:28
interesting.
33:29
Do you wanna be one of those weird wonderful people and help
33:33
us get off to a smashing start? Can you help us log on Twitch on
33:39
Monday, 08/17/2026 at 11AM eastern and say with massive
33:44
giggle stifling grins on our faces that we are already well
33:49
on our way to our membership goals for the year. Would you do
33:54
that for the low low price of $4? If so, please head to
34:00
neverpo.st to become a member. You can get access to an ad free
34:03
feed of the show, monthly at least members only uploads and
34:08
more.
34:09
Neverpo.st, but you knew that already. Never Post's producers
34:13
are Audrey Evans, Georgia Hampton, and The Mysterious.
34:16
Doctor first name, last name. Our senior producer is Hans
34:19
Buto. Our executive producer is Jason Oberholzer, and the show's
34:22
host, that's me, is Mike Rugnetta.
34:33
If a shaft of light is broken into a thousand pieces and each
34:38
piece into a thousand more, might not a stranger mistake any
34:42
of the fragments for the original light? Am I not such a
34:46
stranger? And if so, how can I speak of light or its origins?
34:51
What I have taken for light may be something entirely different.
34:55
Blood or mire or darkness itself.
35:00
Excerpt of the interior prisoner, translation of an
35:04
unsigned manuscript written at Salamanca around nineteen o two
35:08
by Jeffrey O'Brien. Never Post is a production of Charts and
35:13
Leisure and it's distributed by Radiotopia.