Skip to content

Re-illustrate Series Three from real photographs (40 of 50) - #14

Merged
ralyodio merged 1 commit into
masterfrom
series-three-real-faces
Sep 8, 2026
Merged

Re-illustrate Series Three from real photographs (40 of 50)#14
ralyodio merged 1 commit into
masterfrom
series-three-real-faces

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Replaces the art withdrawn in #12. Every portrait is now generated image-to-image from an identified photograph of the actual person, so the faces are likenesses instead of inventions. The 10 cards with no verified photograph carry a plate saying so — nobody gets a fabricated face.

Finding the photographs

New scripts/security-refs.mjs. Identity is verified, not assumed, because a name search returns humans rather than the right human. Left unchecked, this pipeline wanted to put:

Card What the naive lookup found
Michael Howard the British Conservative Party leader
Robert M. Lee a Confederate general (via a Julian Vannerson daguerreotype)
Mark Dowd a Liverpool city councillor
Jeff Williams a Canadian rugby player
Ivan Ristić an art historian
Martin Roesch a different Martin (Wagenleiter)

So the resolver requires a surname match against the Wikidata label, rejects photographs dated before 1950, requires a Commons filename to open with the person's full name, and carries an explicit reject list with a written reason per entry. Everything that survived was still reviewed by eye against a contact sheet — which is what caught the rest.

Sources in order of authority: hand-verified overrides → Wikidata P18 → Commons search → nothing. 24 are independently confirmed by the file being used on that person's own Wikipedia article. Openverse turned up CC BY-SA conference photography for Venema, Deraison and Ptacek, including a hack.lu 2006 set that incidentally proved the Wikidata P18 for Venema is a different man.

Attribution

Most references are CC BY or CC BY-SA, and a conditioned portrait is a derivative work, so the photographer is credited on the card back and in a "Portrait" block on the card page. data/security-references.json carries source, licence and licence URL per card. Photos that are ordinary bio shots rather than freely licensed are recorded as supplied rather than claiming CC terms the deck cannot back.

The reference photographs themselves are gitignored — painting from them is a different act from redistributing them, and security-refs.mjs fetch re-obtains the set from the manifest.

Verified

  • Portraits compared side by side against their source photographs; likeness holds (including Parisa Tabriz's pink hair, which is in the source rather than invented).
  • Full 50-card contact sheet reviewed: Denning and Perlman render as women, Snyder correctly, Lee with the red beard, Diffie white-bearded, Grossman short-haired.
  • tsc --noEmit and pnpm build clean; 50 card fronts, 50 card pages, credits rendering.

Still faceless (10), pending a licensed photograph

Gerald Combs, Robert Hansen, Jeff Williams, Gary McGraw, Michael Howard, Ivan Ristić, Mark Dowd, Thomas Dullien, Heather Adkins, Katie Nickels.

🤖 Generated with Claude Code

https://claude.ai/code/session_014htrUgbnoKQt9iT4G7hUpy

Replaces the withdrawn art. Every portrait is now generated image-to-image from
an identified photograph of the actual person, so the faces are likenesses
rather than inventions. The 10 cards with no verified photograph carry a plate
saying so — nobody gets a fabricated face.

Finding the photographs (scripts/security-refs.mjs)
---------------------------------------------------
Identity is verified, not assumed, because a name search returns humans rather
than the right human. Left unchecked this pipeline wanted to put the British
Conservative Party leader on Michael Howard's card, a Confederate general on
Robert M. Lee's, a Liverpool councillor on Mark Dowd's, a Canadian rugby player
on Jeff Williams', and an art historian on Ivan Ristic's.

So the resolver requires a surname match against the Wikidata label, rejects
photographs dated before 1950, requires a Commons filename to *open* with the
person's full name, and carries an explicit reject list with a written reason
per entry. Everything that survived was still reviewed by eye against a contact
sheet, which is what caught the remaining bad matches.

Sources, in order of authority: hand-verified overrides, Wikidata P18, Commons
search, then nothing. 24 are confirmed by the file being used on that person's
own Wikipedia article. Openverse turned up CC BY-SA conference photography for
Venema, Deraison and Ptacek, including a hack.lu 2006 set that also proved the
Wikidata P18 for Venema is a different man.

Attribution
-----------
Most references are CC BY or CC BY-SA and a conditioned portrait is a derivative
work, so the photographer is credited on the card back and on the card page, and
data/security-references.json carries source, licence and licence URL. Photos
that are ordinary bio shots rather than freely licensed are recorded as
"supplied" instead of claiming CC terms the deck cannot back.

The reference photographs themselves are gitignored. Painting from them is a
different act from redistributing them, and `security-refs.mjs fetch` re-obtains
the set from the manifest.

Still faceless (10), pending a licensed photograph
--------------------------------------------------
Gerald Combs, Robert Hansen, Jeff Williams, Gary McGraw, Michael Howard,
Ivan Ristic, Mark Dowd, Thomas Dullien, Heather Adkins, Katie Nickels.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014htrUgbnoKQt9iT4G7hUpy
@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

4 finding(s)

MEDIUM: 4

Severity Rule Location
MEDIUM js-credential-logged scripts/migrate.mjs:16
MEDIUM js-unescaped-html-sink src/app/cards/[slug]/page.tsx:60
MEDIUM js-unescaped-html-sink src/app/hacking-legends/[slug]/page.tsx:68
MEDIUM js-unescaped-html-sink src/app/security-professionals/[slug]/page.tsx:68

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 9c46480 into master Sep 8, 2026
4 checks passed
@ralyodio
ralyodio deleted the series-three-real-faces branch September 8, 2026 02:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant