arnarbi

You are correct, but it's generally very hard to come up with good access control policies up front. Also, as you grant more access the system tends to become over-permissioned over time, and often you don't really find out until so wrong that it hurts. The ability to audit is necessary to maintain good policies. It allows you to discover gaps in your policy even when things didn't break terribly.

Very cool. Is it controlling the plugs via direct Bluetooth connection? Or zigbee via a hub, or wifi (direct or via service)?

I always assumed, probably incorrectly, that there would be too much jitter in the actual timing so I had built a few prototypes of e.g. an esp8266 controlled relay, where you would give the MCU a duration rather than separate on/off commands. But I guess that was wildly over-optimizing. In your case, how stable is the delay from the app sending a command until the switch operates?

I'd add voice mode for color printing in total darkness.

I think it’s a little different.

The restaurant fee isn’t a fee for something “extra”, it’s just a blanket extra charge on everything.

It’d be like the airline sold you a ticket for $500, but as you step off the plane at the destination they say “actually it was $550”, because it said so in the fine print.

Restaurant owners interviewed in the media here in SF are directly quoted saying they can’t do that because “customers would notice”, or think “oh that’s expensive, I can’t eat out twice a week”.

These are arguments for including the fees that make the customer __still pay the same higher price__, implying that the whole point is that they won’t notice. And reporters don’t seem to even register the absurdity of those remarks or question them in any way.

https://www.sfgate.com/food/article/sf-restaurants-junk-fees...

https://www.kqed.org/news/11992412/californias-junk-fee-ban-...

Scorched Earth was also my first hacking target. Found out that your cash balance and weapons inventory was all stored in a mysterious .ini file and you could just edit it.

Best "friendmaker" hobby I know is sailing.

It's in general a very newcomer friendly hobby, which is both important as a newcomer yourself as well as for meeting new people once you are into it. It's naturally collaborative so you have to communicate, not very intense so there's a good amount of chill time, and in the cases where small-talk doesn't turn up interesting topics you can always talk about sailing itself.

It's more like workers on a large oil tanker using bicycles to move around it, rather than trying to use another oil tanker.

> why they're attributed to AI?

I don’t think they mean scrapers necessarily driven by LLMs, but scrapers collecting data to train LLMs.

We did not, no. Just wrote up the report and moved on.

Back in college (~2008) we implemented this with a 7 foot tall back-projected screen and a couple of Wii remotes after seeing Johnny Lee’s video. The nice thing with that screen was that you could stand so close to it you couldn’t really see the edges.

We had as many people come test as we could, and we found that 90% of them didn’t get a sense of depth, likely because it lacked stereo-vision cues. It only worked for folks with some form of monocular vision, incl myself, who were used to relying primarily on other cues like parallax.

It is not based on TB but it is heavily informed by those efforts. See here: https://github.com/w3c/webappsec-dbsc#what-makes-device-boun...

However, DBSC as an API and protocol is similarly agnostic about key storage. There is no attestation and the User Agent is fully responsible for selecting key storage that provides the best protection.

> why they don't have TLS try and always create a client certificate per endpoint to proactively register on the server side

That is effectively what Token Binding does. That was unfortunately difficult to deploy because the auth stack can be far removed from TLS termination, providing consistency on the client side to avoid frequent sign outs was very difficult, and (benign) client side TLS proxies are a fairly common thing.

Some more on this in the explainer: https://github.com/w3c/webappsec-dbsc#what-makes-device-boun...

Services can certainly make this safer by providing means to get more restricted credentials, so that users can deputize semi-trusted delegates, such as agents vulnerable to injection.

The important point being made in this discussion is that this is already a common thing with OAuth, but mostly unheard of with web sessions and cookies.

It’s the same thing: https://fidoalliance.org/passkeys/

This is a very good point, and one the DBSC team thinks about a lot.

In the short term it's about economics: Infostealer malware today scales really well because it can a) exfiltrate cookies quickly and clean it self up, mostly evading any client based detection, and b) sit on large stashes of long-lived cookies and carefully "cash them in" in ways that evade server side detections.

A short-lived cookie forces different behavior for b, which we think will make it more detectable server side, and binding in general will force malware to act more locally, which will make it (far) more detectable locally.

In the long term, DBSC also is designed so that the session management and key registration is somewhat decoupled from that short-term cookie business. If and when we can sign more often (perhaps every request), I believe the DBSC API will still be useful for websites to manage the session key and lifetime.

There are many sailing schools around SF, but one that stands out is https://www.cal-sailing.org/ - as it's by far the least expensive and low-commitment option to get on the water, and they have dinghies in which you'll learn very fast (but also get wet). Instructors are regular volunteer club members and mileage may vary, so make sure to go out with a few different ones.

Another good way to get started is to find crewing opportunities for casual racing on https://www.latitude38.com/crew-list-home/. Many skippers will take no-experience folks out for fun. (It may take a couple of attempts to find a skipper/crew you enjoy hanging out with)

There was a pretty good video on this a couple of years ago: https://www.youtube.com/watch?v=QFv3QPNU6hw

Garfield is certainly (meant to be) real, but I've never seen a strip that confirms that Jon can actually hear Garfield's thoughts. I think that's why Garfield minus Garfield works so well.

It’s not induction. It’s just the contrapositive of “if you can solve the simpler problem then you can solve the harder problem”

You used to be required to adopt an Icelandic forename - not surname. You still kept your original name (if you wanted) and it was up to you which one you used on practice.

But as sibling comment says, that’s been dropped.

For surnames, anyone (including Icelanders) is allowed to use a family name if they have a claim to one, which is defined as having a parent or a grandparent carrying that name as a surname. So foreigners with family names can pass those to their children if they like and skip the patronym.

Is that really price discrimination?

“Enthusiasts” might have legitimate reasons for preferring hardcover (durability, aesthetics, etc) and are willingly and knowingly paying extra for that.

How much it cost to manufacture is mostly irrelevant.

> They are (or were) refusing to provide any indication to those other companies that these are not, in fact, the same people

That is not quite true, the sub field will be different.

“They” in this case included me and this was a deliberate fix for poor UX many years ago. We definitely thought about it and we used to blink only the key that had a credential from the allow list, because like you we thought that made the most sense. But people got routinely stuck because they just tapped a different key out of habit and nothing happened. There was no way for the browser to tell them “not that key”. Best case the reports would say the key was dead because it didn’t blink.

We changed it to blink all keys, so that if you tap the wrong one, the browser can at least tell you something sensible and get you unstuck. This wasn’t a hypothetical shot in the dark, but something we tested and actually worked well for real users.

I don’t disagree that WebAuthn has grown well beyond anything we could call good spec design. But it’s worth remembering that there’s /a lot/ of context behind it, and that the average user doesn’t behave anything like an average HN reader.

> hoping the other keys with timeout before the use actually have to use them

Both Chrome and Android will cancel requests to all other keys. If your keys are locking up until a timeout it’s more likely the key itself is buggy.

Chrome on desktop did: https://developer.chrome.com/docs/identity/webauthn-signal-a...

I have the same fantasy. I think it’s appealing because I imagine they’d be able to appreciate all the amazing things behind it more than most people, dead or alive.

Stained glass won’t (I think) shift any frequencies. It will attenuate different frequencies differently, but it won’t make up new ones.

So when the signal frequency changes, you’ll still see that change, but the light might get brighter or dimmer at the same time due to the stained glass. But you don’t care about the brightness to begin with.

> What am I missing?

The tree blowing in the wind will introduce its own amplitude (brightness) fluctuations. It will be hard for you to tell which amplitude changes are signal from the source and which are noise from the tree.

Edit: Looks like you answered yourself while I typed that, where you added:

> Couldn't this be dealt with if you know the details of the tree's dimming ability?

If the tree is moving, and you’re far enough away to resolve individual leaves (which is not unreasonable) then its “dimming ability” is constantly changing.

Others have answered correctly (it was an arbitrary choice), but fwiw I always found it helpful to think of current as the direction of the “holes” where electrons can be.

Like bubbles rising in water, the holes “travel” opposite the potential that’s pulling the surrounding electrons the other way.

He's also the one running for president.

https://grapevine.is/news/2024/04/03/comedian-and-former-rey...