news · #7

Catch the Tamper

One of these charts is doctored. Can you tell which?

Leftoriginal
Rightdoctored
Eyesmiss it
sha256catches it
0 100 200 300 400 340 Eng 265 Sales 190 Ops 85 Legal Total: 880 Q3 spend by team ($K) SlickFast
0 100 200 300 400 340 Eng 265 Sales 190 Ops 95 Legal Total: 890 Q3 spend by team ($K) SlickFast

The $10K slide

Legal moved from $85K to $95K in the right-hand chart — a $10K edit most eyes slide past in a deck. The fingerprints do not slide:

If the original fingerprint was published — in the email, the caption, the meeting notes — the edit is detectable by anyone, forever, with arithmetic. No audit team. No comparing pixels. One command.

What every SlickFast chart ships with

The fingerprint rides in the twin (add `.json` to the URL) and the response headers of every chart and Page — nothing to enable, nothing extra to pay.

Your eyes cannot audit. Arithmetic can.

Same rule on Pages: the seal in the chrome is the fingerprint of the pagespec. Twin and Page must agree — or someone changed the recipe.

Takeaways (humans)

1. Publish the fingerprint with the picture — email, deck, ticket, caption.

2. Open the twin (URL + `.json`) when you need to prove what was shipped.

3. A small number change is still a different chart — the hash flips; the eye often doesn’t.

Takeaways (agents)

1. Never treat pixels as source of truth — fetch the twin; report `specHash`.

2. If hashes disagree, say so loud — do not “fix” the picture.

3. Speak facts + URL — keep the twin; don’t dump HTML (News #6).

One sentence to steal

Catch the tamper with the fingerprint — not with your eyes.

Doors: News · Archive · Get started

fingerprint sha256:1358ef0fd4ae9c56e0a7d4d08f5873d95942300f374b9573046265d072e4f376 · verify: add .json to this page's URL