2,324 karma · joined August 2, 2025
Heck, the only thing it's probably effective at is tiring the general population with non-solutions that reduce their quality of life. People know it doesn't do anything, and yet they have to engage with it.
Even worse is the fact that support for S3 sleep is going away, so if that did work for you, you'll be pushed over to using S0 sleep, which also doesn't actually solve this problem to any significant degree.
Personal devices shouldn't be used for work purposes to begin with. If work has security requirements regarding what phone and what condition it is in, they better be supplying their own phone to ensure those requirements are satisfied.
However, the looming threat of that being possible, and Apple not being able to block it from happening, will hopefully prevent Apple from making the App Store experience worse than it needs to be, both from the user's perspective, and the publisher's perspective.
So notarisation is still on the table? I won't be surprised to see Apple using that for all the loophole its worth.
That is, unless that's already covered by the ruling and I just didn't see it while skimming. Maybe the Alternative Distribution Channels is that, although it doesn't seem to be defined beyond 'a suitably qualified third party', which I'm sure Apple would love to say is no-one.
Still, the rest of it is very nice. The altstores for Apple have seemed kind of useless to me just through either costing money to use or needing to connect to a PC every so often, or needing to perform some other stupid dance. If we can get the F-Droid of iOS and an option to just download and install an IPA if I want to, then I'll be pretty happy.
Heck, even roving bandits in the absence of any government proper are a government of a sort. Just a really bad one.
I feel the same way about this that I do about removing Flash support: it's good that we're moving on to better things, but that doesn't help if there aren't better things to move on to.
What's the simple goto for making web based games that kids can mess around with? It was Flash, and now it's nothing. How do you set up an RSS feed to not just blast raw XML at the user? Soon it won't be XSLT any more, but I don't see a good replacement (even more annoying is the fact that browsers used to have features to handle RSS feeds by themselves, and XSLT was used to sidestep that problem, but now there's no more side to step).
Battle.net is still limited to Activision-Blizzard, with a sprinkling of other Microsoft IP following the buyout. Although that might change soon?[3]
[1] https://www.ea.com/ea-pc-third-party-titles-2022
[2] https://gamesbeat.com/ubisoft-welcomes-third-party-games-on-...
[3] https://www.gamedeveloper.com/business/cd-projekt-red-and-bl...
Ubisoft and EA have more or less surrendered. Battle.net is distinct enough with a group of exclusives including WoW to keep going. GoG is kept alive by its one single USP, and its launcher isn't even relevant to that, so it's just there, not really doing anything. Epic is seemingly trying to compete against Steam, but seems blind to the reasons why people like Steam.
That's honestly just because I can't reuse paper I've already written something on. That's a limitation of paper I'm glad the digital did away with.
I've used some pens for years. Once I found one I liked, I stuck with it.
I switched to Linux to get away from the UI churn. Things changing without my consent does not bring me joy, but it's not like you really have a choice if you run Windows (or a distro with a DE that does do the churn).
I don't know my TOTP secrets. They're far too long for me (or any reasonable human) to memorise them. The only way to use them is to have physical access to them (unless I post them publicly on the internet, which I don't).
My first factor is 'something I know'. That it my password to my password manager. My second factor is 'something I have'. That would be my 2FA codes/secrets. I keep backups of both. Someone getting access to my 2FA secrets is extremely unlikely short of someone breaking into my house and stealing my encrypted NAS or my second encrypted backup. That's not a threat I intend to counter with my threat model. On the other hand, getting locked out of an account is a threat I do intent to mitigate, and thus, not having backups is not a viable alternative for me.
I use normal TOTP with Microslop. Presumably you can opt into a worse version if you use their enterprise software, if you're evil or whatever.
The rest I presume fall into the bucket of 'wants to cause their users pain and suffering'. That's the normal modus operandi for Adobe and Cicso at least. The only one of those I use is Steam, and I haven't needed to log into Steam in over 2 years, since I'm just always logged in. Fair point though.
> Fair enough. I find TOTP to be a PITA.
I do too. Yet passkeys manage to be even more of a pain in the ass with ominous potential consequences on the horizon. If it was TOTP plus some phishing resistance without any actual downside, I'd have no beef. If it was TOTP but simpler, then there's be negative beef. There are however several clear and present downsides to passkeys. That just makes for a worse tradeoff (depending on your values) rather than a genuine improvement.
The people who wrote the spec. If the spec didn't care about what software was being used to handle passkeys, they wouldn't have written in the ability for whatever you're authenticating to to know that.
The spec is bad and the people who wrote it should feel bad.
> In practice I'm aware of more 'lock in' behavior in the form of restricting which TOTP client is accepted than for Passkeys.
I've never seen this before. This reads like FUD to me. Every single site that I use TOTP with (40~ going by the number of secrets I have) didn't give a shit, and I don't see how they could, unless they use Super™ Special™ TOTP™ just because they're so special and wish pain and suffering onto their users. It's just a QR code you scan or a secret you manually type in, which then gives you some numbers you use later, and that's all it should be.
> Bitwarden also syncs TOTP. Given it's the same client, why push folks to opt for a provably weaker protocol with higher potential for user harm?
TOTP doesn't have a higher potential for user harm. If you use it with Bitwarden, the phishing resistance passkeys tout is something you already mostly get (you can still manually copy the code, which I believe to be a good thing, believe it or not).
Given how inconsistently passkeys are implemented and how it's more difficult to get at the actual data being used (unless you export them with Keepassxc (or Bitwarden?), the potential for fuckups is much higher with passkeys.
I'm yet to see someone get phished. It must happen, given that's how passkeys got started. But the far more common ways I've seen are sessions getting snatched and data leaks, neither of which passkeys protect against. It's a marginal benefit in exchange for so many downsides.
It's not FUD. It's just my opinion and a bad spec.
TOTP is already 'good'. Passkeys are worse because of bullshit like this.