AviationAtom

They talk a little about the state of the project and it's ability to scale here: https://beehaw.org/post/438094

A copy of this particular post:

https://beehaw.org/post/439761

Other interesting posts about Lemmy and scaling:

https://beehaw.org/post/434849

https://beehaw.org/post/438094

Beauty of the Fediverse?

https://beehaw.org/post/439761

I really see it as an evolution of the problem with cell phone cameras. People will pay good money to sit at a concert, recording the concert on their phone (in crappy quality), rather than to actually live and experience the moment.

I agree with all the mentions of dystopia, and have often considered the "Metaverse" to very much embody such. Then I get to thinking and realize the Gen A'ers will soon enough exclaim "Okay, Millennial" when we shout of these things being dystopian.

$3500

Good making the distinction between the two.

Google has been very explicit that they will not analyze emails of Google Workspace subscribes for ad targeting, but says little about how in-depth they analyze for Gmail users.

We already know the likely answer to this. They didn't make it terribly evident to Google Voice (Former Grand Central) users that their data was being utilized to train their transcription models for visual voicemail and the like. Google has long since strayed from their do not evil model.

People would be wise to de-Googlify their digital presence as best they can.

The new Gmail ads are atrocious too, IMHO. Peppering ads that "appear" as emails into my Gmail feed seems over the top. I'd rather pay $6/mo, and do, for a single-user Microsoft 365 tenant, which nets me 1TB of cloud storage, in addition to 50 GB of email. I trust Microsoft more than I do Google at this stage.

Checkout Claude, from Anthropic. It's a team of ex-OpenAI folks. The results I've seen from it thus far have been most impressive.

Google and OpenAI have more or less acknowledged that open source is going to dominate, in part due to the guardrails that corporations will be expected to put in place to "protect" their "vulnerable" population from the effects of "bad AI."

The truth is the AI only "hallucinates" as bad as the input (prompt) the user gives it. If you're explicit in your prompts then more often than not you will get explicit answers, instead of random answers as a result of your failure to provide clarity in what it is that you seek.

Hate to break it down further, but you're more or less asking for the equivalent of an IQ test to be able to use Google, IMHO. I don't blame you for seeking such, but there's a huge contingent of people that would call such a demand an improper one.

I tend to side with your view, as I can gather it, that you treat the problem (people not critically thinking) rather than the symptom (preventing people from being given potentially unreliable information).

The recent news blip on the lawyer letting ChatGPT create their filing, then them claiming they trusted that the cases ChatGPT actually existed, and were indeed precedent-setting case law, is an example of pushing towards the idea that everyone needs to be treated like toddlers. I just think we should expect more from people, rather than the technology their utilizing.

I think it's a byproduct of a shift in RLHF to favor more "responsible" AI, as a result of huge community fears of the potential negative impacts of AI. Essentially "neutering" the AI's capability.

Much like some people struggled with how to properly Google, some people will struggle with how to properly prompt AI. Anthropic has a good write up on how to properly write prompts and the importance of such:

https://console.anthropic.com/docs/prompt-design

Have you tried Claude, from Anthropic? I've found it to be far more useful than GPT-4

It would be tough to also factor in the balance of that weight on the aircraft. Too much weight fore or aft of the wings can be deadly.

Bad aircraft weight and balance absolutely can cause crashes and get people killed. It's less so the larger the aircraft gets, but still relevant.

They seemed to like it less when we blocked it, as their stuff completely failed to work.

Compliance sucks, but it's required. I didn't make up the rules, just implemented and enforced them.

Not sure you'll see this, with HN's lack of notifications, and so much time elapsed but here's the answer:

Most consumer routers do not support disabling the web interface on the local network, as it's the primary (only?) means of administration for them. This attack relies on getting users to browse to an address with default creds by some means, with a URL prepended that will cause the desired action to occur. More often than not a popular action is to modify the DNS servers used, so that DNS traffic can then me manipulated to point to malicious servers used for the ultimate attack.

This domain has zero to do with home use and everything to do with enterprise. DNS is one of the best tools for detecting and sinkhole'ing malicious domains using threat intelligence feeds. If the systems on your network are bypassing your DNS servers then you lose that visibility and ability to filter malicious DNS traffic.

If you're doing it right then you're using GPO and/or the policies file to lockout the ability to tamper with your preferred DNS settings on browsers in the enterprise.

I made it a point to NAT redirect all outbound requests to UDP 53 in our enterprise back to our enterprise DNS server. It would sometimes piss off our engineers, when they realized 8.8.8.8 was somehow resolving our internal DNS names, but if they came to us and nicely explained their use-case then we excluded them from the NAT rule.

It's been noted elsewhere in the comments, but I think it's worth pointing out that 1Password incorporates a similar algorithm for random password generation. It allows you to configure a series of uppercase words, lowercase words, special characters, and numbers. i.e. CAR-horse7ambulance

I think you're misunderstanding the intent of this. It's meant to stop the theft of text authenticators, from breached databases. It shifts from "something you know" to "something you have." The problem with "something you have" to this point is that your average consumer doesn't want to buy and use a Yubikey. It's making PKI (which the DoD still uses for authentication) much more accessible, available, and convenient, for the average user.

Correct. Nothing is centralized about Passkey (other than where you may choose to store your authenticators). Each site gets a unique keypair. If your keypair is compromised you can delete it on that given site.

Passkeys is more or less just a more convenient implementation of FIDO2 or the like, as you'd traditionally have with a Yubikey token. Instead you move it to a supported password manager or mobile device.

If you want to try it out go to https://passkeys.io on your Android or iOS device. I do believe Passage is more or less what Passkeys is/already was.

You hit it right. It's not much different than saving your HOTP/TOTP key into your password manager. Instead you'd save the WebAuthn private key and nobody could impersonate you without gaining access to your private key from your password manager (1Password, Android, iOS, Chrome, etc.). At least that is how I have come to understand the inner workings of it all. People rely on PKI for encrypting messages, signing messages, secure remote access, etc., so I think it only makes logical sense to extend it to web application authentication.

Again, as I mentioned, the bulk of those rely on default creds.

Many of the big manufacturers have been tackling that issue by forcing a password change at setup and not allowing an insecure default to be chosen.

If you don't expose any external services of the router then it's a bit hard for botnets to take advantage of your router.

Most of these routers are likely becoming part of the botnet for enabling external web management and/or using default creds (especially if SSH is exposed externally).

Security isn't exceptionally hard, if you actually put some effort into it.

Merlin really is the best option for Asus, as Broadcom sucks about their drivers

The site this whole case centered around is Canna.to, in case anyone wondered. Still resolvable by Google DNS.