Ferret7446

This is ignorant fearmongering. Attestation has existed for decades, for enterprise use cases. Now decades later, people discovering attestation for the first time are panicking. If you had panicked a decade ago, that reaction might have had more merit.

1. It's not that complicated

2. The complexity in the standard is there to ensure things are done securely (think: not doing password checking via comparison loop).

3. The unnecessarily complexity in individual implementations in websites and passkey stores is due to general baseline corporate "incompetence".

The same as using a browser to visit a website. Depends entirely on what data your client sends to the server and how unique that data is.

> The attestion part only serves to strengthen to Google/Apple duopoly

That's strange, since neither of them are a big player in the attestation enabled key manufacturer market. AFAIK Apple doesn't even make keys, and barely anyone uses Google's keys. You even mention Yubikey, yet somehow think Google and Apple have a duopoly here.

That has nothing to do with the standard. Any website can invent its own proprietary authentication extension and try to force it on its users. If a website wanted attestation and the standard didn't have it, they'd just make their own extension. See Apple with Thunderbolt.

That's entirely a problem with one implementation and not the standard. It's like complaining Torx is bad because one manufacturer adds stabby bits to the handles of their Torx screwdriver.

> Into a hash algorithm not to a remote server.

You know what MITM is, yes? There are a ton of points between you and that hash algorithm, and any single one immediately and permanently compromises you.

Meanwhile passkeys are completely invulnerable.

> Passkeys have to be online to enroll additional keys

No they don't? A passkey is fundamentally just a private key pair, which can be copied around just like a very long password. Of course if you store it inside one hardware enclave and want to move it to another hardware enclave you have a problem, but for software implementations it's simply a client UX issue.

> Attestation is certainly a stain on the WebAuthn spec

Attestation is necessary for corp use cases. Adding it as an option to WebAuthn is better than forcing more standards to be developed.

Break pads on ICE wear out slower than EV due to torque and weight difference (but also greatly subject to driving style of course). Similarly EV tires wear out faster creating lots of very bad pollution.

Forever stamps guarantee delivery forever (subject to terms and conditions on weight/size). Regular stamps denote value, e.g. 50 cents. They will always be usable but you will need to match the inflation of prices (e.g., mailing a letter might be 50 cents in the past but 100 cents in the future)

Numbers for demonstration only

Not true due to induced demand. Traffic increases when more lanes are added to a highway. The alternative to $200 in AI costs is not $20,000 in labor costs. The alternative is nothing because the work was never worth $20,000. So the AI did not eliminate $20,000 worth of hypothetical labor.

AI creates demand for things that didn't exist previously

They have unlocked value by paying for their AI subscription. They paid $X and using it produced for themselves more than $X worth of value

That is not really how agents work? You can't reliably stop an agent from writing out its context and even if you could that would just make the agent horrible and unusable at performing tasks in general (e.g. delegating to subagents)

I don't think export is necessary. Most of the value is in the context, you can always prompt your agent to vomit all of its context out into markdown files in some repo and then pass it on to the next agent

I have heard that boating and aviation have similar financial financial outcomes to gambling. Keep in mind that the majority (way more than 50%) of people can engage with gambling safely, it is a minority that get into trouble

I wouldn't be surprised if they actually filtered those out of your ad target model. Most people don't care if advertisers know they like cooking, but not so much their fetishes

Freedom == more rope for the user to strangle themselves. Most casual users don't care for that

You can just install an open source distro. The environmental impact is user laziness (which is pretty much true of all environmental impact)

I assume the support range is determined by firmware updates. I know ChromeOS struggled with supporting devices whose components no longer received support.

It's not quite that bad. Just freeze/archive the old, rewrite everything to the new, then dump a lookup table somewhere to remap SHA1s.

Tools and scripts will have to be migrated of course, but I'm the brave new world of agentic coding it shouldn't be too hard.

The main pain is providing user support to developers who are curiously not very tech/OS savvy (has anyone else noticed this phenomenon?)

They aren't really. It's basically like getting an auto generated ref/branch name for each new commit, with convenience rewriting every ref when you rebase.

It's a bit more convenient if you prefer referring to a non-leaf commit directly rather than relative to the leaf branch a la master~2

Having switched to jj I don't really agree. Everything I do is basically the same as with branches, just that I get randomly generated tip names rather than naming them myself, which is both slightly convenient and slightly annoying

The "a ton to learn about how to control an LLM" is remarkably similar to learning how to work with a new team of humans, perhaps easier. LLMs though eccentric are far more predictable than most humans.

The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.

On the contrary, they behave exactly like moderately autistic humans

They act exactly like how I would act if I were dropped into someone's machine and tasked with accomplishing a goal "at all costs". Hunting around for context to understand what I'm dealing with and to an extent profiling the previous user for their workflows and competency.

The same way you do for humans, regular training and audits.

Counterpoint: hoarding resources is an evolved, beneficial trait, at least in the past. Frugality is a very modern virtue

IIUC it works over SSH which would be kind of nice I suppose