Telaneo

> Short of somehow talking a user through finding the full private key and getting them to send that to you, there is no way to trick a user into giving you what you need to get into a website impersonating them.

So you're telling me they're phishable?

TOTPs are already not that great in my opinion. It's like democracy: the least bad option. It's a decent trade-off between convenience and security, so I'll stick to unless there are good reasons not to. Passkeys have managed to make that experience worse, with a very large potential gotcha in the future, while not introducing any improved security I see why I should care about.

If it looks like a duck...

Could we drop the 'to minors' part of that? Either way, great move.

Can't even pirate things before companies recklessly decimate their archives these days, apparently.

Looking forward to seeing this expanding our understanding of the Hittite lexicon and its relationship with the rest of the Indo-European languages.

How did that work out for them?

No, they do not infact hate pancakes.

GrapheneOS requires it.

> StrongBox keystore provided by secure element

https://grapheneos.org/faq#future-devices

I fail to see how you read that from that quote.

> I literally provided a citation.

That I said does not support your statement.

> A syncable credential is by necessity representable in clear text at some point.

I never said this was wrong.

> WebAuthn is a _superset_ of Passkeys

I don't see how your quote illustrates this, and I've only heard them referred to as the same thing. Would you care to elaborate? And maybe provide an example?

It's really annoying that minimum wage and the like aren't pegged to a general 'cost of living'-number that scales with inflation and whatnot. Peg the wages of the politicians to the same number. If they then want to increase their own wages, they have to also increase the minimum wage, or go out of their way to only increase their own wage, which will hopefully cause some people to call them out on their shenanigans.

Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.

Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.

I want it, in the same way I want a laptop with Linux. I can install it myself, and I already have done, but I wish the option was viable for most others, so that more of the market is open source.

For routers, the only realistic way that can happen is by getting some big vendor to adopt ddwrt or openwrt to offload (some of) the job of writing the firmware. And even then, most people use their ISP provided router. A niche vendor supplying preflashed routers isn't going to make a dent.

> Sigh. IT LITERALLY IS.

> The name "passkeys" itself means "exportable keys":

> https://fidoalliance.org/passkeys/

This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked. Nor did I see anything indicating that was a core part of their design from a cursory reading of the page, although I might have missed something. Your quote certainly doesn't imply 'exportable'.

Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended. To quote Tim Cappalli, who's credited on the W3C spec as an editor[1] and maintains passkeys.dev,[2] so presumably knows what he's talking about: "Passkeys should never be allowed to be exported in clear text."[3]

[1] https://www.w3.org/TR/webauthn/

[2] https://passkeys.dev/about/

[3] https://github.com/keepassxreboot/keepassxc/issues/10407

> Passkeys are _by_ _design_ representable as clear-text strings. You can export them and sync between devices.

That's not the intention of the relevant standards.[1]

[1] https://github.com/keepassxreboot/keepassxc/issues/10407

And then undermine that effort by actually asking for that code anyway.

Given the amount of dependency bullshit I've had to deal with over the years, I'm glad the idea of using shared libraries for everything is dying. I like the core idea of it, but the implementation has never actually Just™ Worked™ in my experience outside of either trivial or curated examples. I guess all those mature applications discovered the same thing.

Flatpacks are great. I've barely ever had a problem with them, and the problems I did have were solvable with a cursory web search. Yes, they take up more space. That's a worthwhile trade-off in exchange for actually working.

And even if they theoretically can serve you, one generally doesn't want to be 'that guy'.

I'm glad the option is still there in most places, but it's clear most people don't actually care for cash (neither do I for that matter, other than as a backup solution).

> This is objectively not true because there are companies, even banks, where this level of stupidity has not prevailed.

All it takes for this to happen is the lawyers not knowing.

Many devs love to shit on the guy from the 'I just want the exe. Why is there no exe'? meme. On some level I get it. And in some cases it's not even reasonable to provide a single binary or whatever. But on the other hand, github is being used to deliver end-user software. It is no longer just a dev's workspace/playground. That and the amount of makefiles and python scripts I've seen fail due to some dependency nonsense fills me with rage. It's never Just™ typing 'make' unless the code is trivial. I can wade through the bullshit. I shouldn't have to, and many others aren't even able to.

So long as you know where to look and can quickly check, not remembering is OK. If your boss wants you to remember everything of the top of your head, he's being a knobhead.

> As someone on the spectrum, this does happen to me with people sometimes too; I struggle when asking a question and getting an answer that doesn't fit the "shape" of what I expect (e.g. asking a yes or no question and getting a relatively long sentence in response that doesn't contain either "yes" or "no" in it, which means I need to do the equivalent of applying it as a diff to my mental model and seeing if there are conflicts). This happens less frequently with other humans though, and on average the amount of effort I need try to figure out what they're saying is a lot lower. This doesn't make it less frustrating when I get that kind of output from an LLM, but it doesn't surprise me all that much that it happens.

I've have people in my life where I've got situation going to the point I got sick of it and just started responding 'That didn't answer my question. Do you remember what my question was?'. Turns out many people seem to invent out of whole cloth what your question is rather than actually responding to it. Seems like a whole lot of wasted effort. I mean, it's one thing to ask a yes or no question and getting 'it depends on X, Y, Z, blah blah blah', or just 'I'm not sure/don't know'. There have been far to many cases where I ask something and the response is functionally 'well you see, it all began in 1969, back when dinosaurs ruled the earth'.

LLMs seem to atleast actually respond to your question. The question might be phrased in a way which doesn't match what you intended, and the answer will be verbose and require you to wade through prose to actually find it, or it might just be wrong, but it will at least be an answer to the question you gave it.

If Windows/MacOS doesn't ship git by default, then yes, that should be included. On Linux, the people who are running Linux From Scratch can probably infer what the problem is.

It's in Kerig's interest to be evil in this case. There's money to be made in malice. There's good reason to assume this isn't incompetence.

If you don't get the endorphins afterwards, that sure sounds like not being wired to enjoy exercise.

If normal people aren't, I wouldn't expect lawyers to be either. If there's no happy path to encrypted communication, then it will not happen.

I wish we did better when it came to software support. Hardware can last a long time if some effort is made on the software side. The 6700k isn't supported by Windows 11, but not for any good reasons. It's still got the performance to do quite a lot.

Bulldozer (and thus Piledriver) was stillborn unless you were a diehard AMD fan or an overclocker, so I don't think it's helpful to lump in here.

I'd still use an iPhone SE (released the same year as the 6s) if the battery could be easily replaced and iOS still supported it. I don't do anything on my phone that needs significant performance anyway.

I still keep my 2012 Macbook Pro around as a backup machine if something happens to my main machines, and every time I drag it out to check up on it, it still works great. It stopped getting any significant MacOS updates in 2022, but Linux still gets updates.

Doing the Lord's work.

A somewhat common sentiment I've heard among those with autism and ADHD is that an untraumatised autist or ADHDer doesn't exist. The literal statement obviously isn't true, but a lot of the downwind effects of it are.

Most people are diagnosed with autism or ADHD because they have problems due to trauma, or they have problems which gave them trauma, or them having these problems made them more sensitive, which in turn traumatised them when it wouldn't have done the same to others. Many of the diagnostic criteria are trauma responses or otherwise external signals which have very little to do with the internal experience of actually having autism or ADHD.

What does a well-developed, untraumatised person with autism or ADHD even look like? We can make some broad statements based on assumptions, but many of those people won't even be diagnosed, since they've never had reason to. What made life work out for them isn't an active area of study, since finding that group of people is close to impossible.