BillinghamJ

Despite that, Notion actually does work okay in unstable/briefly offline connectivity situations. It syncs changes when it reconnects.

>Having any information, specifically time information, leaking from your systems may or may not have unanticipated security or business implications. (e.g. knowing when session tokens or accounts are created).

I don't think this is really true? These are not serially incrementing, they just indicate the time it happened. If you have an ID that you know exists, having the ability to know _when_ it was created is very rarely meaningful.

What could present more of a risk is being able to predict a large part of IDs that will be created. Even then though, you shouldn't depend on your IDs for secrecy - best to ensure the IDs are never used as protection by themselves (ie treat them like they're just a simple autoincrementing number, even if they're not)

I was under the impression that it was all stored in the iPhone's secure element, which is part of the main processor? But they're paired cryptographically - to ensure the data isn't faked. And I would think there is some calibration data. Maybe that's wrong though - are there any docs you can link?

That would indicate an issue - i.e. something we don't want. Just that it's not something where an engineer needs to go and mop up, and in theory would continue to operate correctly indefinitely. I guess correct as in - safe but not necessarily the most desirable behavior

All forms of FIDO2 authentication do fundamentally rely on being able to trust the browser to not misrepresent the "relying party" (the RP, aka the registered domain, github.com in this case)

They are phishing resistant, even when using the cross-device QR code thing, but that does rely on some base level of trust in the user agent

At the end of the day though, if the browser is the malicious actor, there's simply nothing you can do. That is not a realistic or defensible scenario in most threat models

Passkeys do represent an enormous improvement in security for users, including in the scenario you've highlighted

I know in traditional auth setups, that kind of situation does tend to invite additional concerns, but (again assuming you trust the user agent) FIDO2 still provides full protection when that's happening

I tend to think of "warning" as - "something unexpected happened, but it was handled safely"

And then "error" as - "things are not okay, a developer is going to need to intervene"

And errors then split roughly between "must be fixed sometime", and "must be fixed now/ASAP"

Perfect shapes do not exist on a physical level, so they're all approximations

https://factmyth.com/factoids/there-are-no-straight-lines-or...

More Microsoft-branded then - GH's current session handling largely predates Microsoft

Why not a year? Or forever?

On all their websites. Microsoft is quite a bad offender of this also.

Yeah, I think the way gofmt does it is basically perfect - leading whitespace is tabs and respects user width preference, alignment across lines is achieved with spaces

I believe his name is Alec btw :)

As did my company, Mojo/mojo.so

Had to wait a few days for recurring/subscription payments to be "approved", but going great since then

We noticed is that it doesn't expose any info about the region/country of the connected account, so we had to make a little adjustment to stop relying on that

Also I think the pricing is a little on the high side, but PayPal people do really seem to like PayPal so not really a concern

Very smooth on the whole

It also can't change at this point. Their flavor is recognized all over the world and many customers wouldn't be happy if it changed. But it's nice to have the blonde roast option at least!

Uh, might be really bad timing on that integration there, as indeed PayPal has been a major missing option for Stripe for a very long time.

But that actually changed extremely recently. PayPal is now fully supported with Stripe, even payment settlement happens in Stripe, Connect is supported etc.

https://stripe.com/docs/payments/paypal

Its availability is limited - based on the merchant's Stripe account. It's not available in the US yet, but I can't imagine it'll be far behind. For EEA + UK + Swiss Stripe accounts, you can accept PayPal for US customers

It seems that it was launched very quietly, not crystal clear why. Maybe PayPal are trying to avoid cannibalisation of their own payment processing services

It used to. They have largely changed that now - all data is deleted once the last app from a given vendor has been deleted (though it's not instant, and seems to apply weirdly on TestFlight + ad-hoc builds)

That's not really fingerprinting - it's just ensuring your login is consistent against the apps of a single vendor

I don't think Apple are aiming to change that with this

Although you're right that Apple Pay is cryptographically verified, you may be surprised to know these two things:

1. you can charge any amount - the amount shown in the Apple Pay UI is arbitrary

2. you can make multiple charges, also of any amount (e.g. for a subscription)

It is tokenized, but practically it's just a card number you can charge like any other card number. It's also typically linked back to the original PAN, so multiple payments can be correlated together with ease

Surprised for that to happen from an Apple TV+ series. I was under the impression all voice assistants had a standard way to play inaudible sound to briefly disable their activation for this exact situation

I wouldn't say the definition is all that clear-cut either: https://en.wiktionary.org/wiki/continent#English

> generally regarded as seven in number, _including their related islands_, continental shelves etc.

Tailing this presumably: https://api.github.com/events

I thought it might be about this JANET: https://en.wikipedia.org/wiki/JANET

Both the 4080 and the 4090 are very expensive, but the 4080 is pretty universally considered to be much worse value for money.

Lots and lots of YouTube reviewers give their opinions and various benchmark-oriented stats around this. Gamers Nexus are pretty good in my view (though their videos tend to take a long time to not say a whole lot)

Surprised he went with a 4080 rather than a 4090. The budget would have covered it, and the performance per $ is much better

You could always manage your packages and their dependencies yourself.

Or you could release a new package manager which does provide support for that functionality, build out a team of maintainers, and stay on top of all the releases

Well it seems like it's working:

- https://news.ycombinator.com/item?id=34739278

- https://news.ycombinator.com/item?id=34736700

Perhaps their thinking is that the kind of people who are into the Steam Deck (especially those who might want to tinker with it a bit) are the same kind of people who might consider a laptop like this. It seems a lot of the idealogical approach/framing is similar between the two.

So get it well known in the SD community -> maybe sell more laptops

Twitter's web version is actually using React Native for web - one of the types of technology people often expect will perform poorly

Klarna operates more payment services than just the BNPL credit option

e.g. Sofort is run by Klarna for some reason - https://www.klarna.com/pay-now/business/merchant-support/wha...

So it seems conceivable that they have options to process regular card payments too