asqueella

This seems to be about ‘go’ proactively blocking emudhra certs even though the system trust store is out of date? https://pkg.go.dev/vuln/GO-2026-6809

Especially when in reality, a warm start with no updates -- i.e. an absolutely unrealistic scenario -- takes 5 seconds just to show the "loading" screen. And 25 more seconds till everything has finished loading and you can interact with the client.

(measured this on the old laptop I use to play the just-released Order of the sinking star)

(the 420 ms to _restore from the tray_ is even crazier -- I remember Firefox used to do warm starts in ~800 ms 20 years ago)

Note there’s no info on that page on which settings get reenabled, only general list of grievances with telegram, mainly from a privacy/security perspective.

I think this should be a warning. Fighting the compiler when trying to draw a diagram is maybe a bit too much...

Has it restarted losing your session to install an "Intel Corporation - Extension - 22.1120.5.12" yet?

The obvious difference is that you have to create that other user (as opposed to denying the ~/Documents request). Also when you curl|bash you normally want to install under current user -- not something you're supposed to do on Linux.

I don't actually believe that macOS protects me here, as I granted this permission to the terminal five years ago...

While you are technically correct, I know for sure that an RP might be unaware that not requiring user verification means Chrome is free to let malware steal the passkey... (Our Keycloak is (mis)configured like that.)

Do you happen to know if this is because Google had to implement sync in userspace, or is it an inherent limitation that could also affect Apple?

Sure, not giving out the secrets to userspace was the design goal of security keys and later TPM+Secure enclave. Passkeys happen to enable the use of such hardware for authentication on the web.

This post claims that before 2025 passkeys used to default to device-bound for Windows Hello and Chrome: https://www.reddit.com/r/Passkeys/comments/1o1j3fk/comment/n... — so it doesn't seem as clear-cut as you claim.

I thought it was maybe a case of convenience trumping security, as by definition you can't sync device-bound passkeys. But it's not clear why synced passkeys must be available for malware to steal (especially without user interaction).

I'm not sure now if the Apple's implementation has similar flaws with stealer malware on macOS: you don't see passkeys explicitly mentioned in mac stealer reports, but I couldn't quickly find a confirmation they are safe either...

I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.

And they claim that for Chrome on Windows:

> Unlike a legitimate user flow that requires user interaction and device unlock, this attack shows how malware can obtain the required signature silently, without user consent, biometrics, device unlock or elevated privileges.

Not a novel idea!

https://xcancel.com/jurijkovalenok1/status/18632434621133989... (Herluf Bidstrup's "Automation")

I was curious what non-fatal condition would make the parents so desperate (to participate in a first-in-human trial):

> Mei was diagnosed with global developmental delay .. some of Mei’s behaviors .. were associated with autism.

> CHD3 mutations produce a condition called Snijders Blok-Campeau syndrome

> people with the mutation often have a normal life expectancy, but their symptoms vary widely. Most have slightly larger than normal heads, and about two-thirds have intellectual deficits. Moderate to severe cases may be nonverbal, suffer from seizures and heart problems, and have fluid-filled voids in their heads.

Bionic is an agent; this appears to be an open-source competitor to lmstudio. The initial commit is just a few hours ago though, so …

I thought this was a long solved problem: the server syncs encrypted data, and the user provides the decryption key from another device (via QR codes, BLE, …)

Seems Chrome-only for now. But the spec (Working draft) has an editor from Mozilla as well, so maybe someday... https://w3c.github.io/mediacapture-extensions/#the-usermedia...

Don't let the hype turn you into a cynic. You're replying to a Rust core team member, who explicitly says the issues are mostly minor, across Rust ecosystem and not in Rust itself, and that they're filing them manually to avoid dumping unreviewed AI output on people.

It's easy to find the 37 issues they have already filed: https://github.com/search?q=soundness+gemini++author%3AManis...

https://software.codidact.com/ was created after one of the many SO dramas. It doesn't come up in searches though and I didn't have reason to use it...

Thanks for not deleting your question — I misunderstood the OP in the same way.

Surely the browser could enforce a limit on a domain, and make sure that the real page you came from (typically the search engine) is prominently displayed.

For those wondering about the language support, currently English, Arabic, Japanese, Korean, Mandarin, Spanish, Ukrainian, Vietnamese are available (most in Base size = 58M params)

People outside US may be able to pay through App store, but not through whatever payment processor you use.

The explanation that made it click for me a while ago was by someone who implemented a shader https://www.alanzucconi.com/2017/10/10/atmospheric-scatterin... — the explanations that don't end up producing an image all seemed to skip over one detail or another.

This is what an Apple engineer could write in the electron's github issue if they refused to fix it.

We're not discussing that, but that they have pushed an update without proper testing. You can see from the other comments that breakage is not limited to people using private methods.

No, for "pushing out updates that cause issues [with very common software]".

The site is awful, and I couldn't find the technical description easily. I assume it runs an exit node for other people's traffic?

Well, mimicking China's GFW is seemingly the objective of some governments. But they are also able to allow some light (text-based) ssh usage and still prevent proxying.

Advanced enough censors (who have DPI) do block or slow down ssh, e.g.: https://serverfault.com/questions/1122015/ssh-blockedfor-for...

Skilled in not falling for the kind of malware, that Defender is able to catch.

It’s not a very high bar: I have not seen it find anything in a long time, neither on my machines, nor on the ones I inspected after they had been owned.

A perfect metaphor for Windows auto-update!

Cool, thanks for elaborating!

Accidentally stumbled on this and not sure what problem you're solving: not wanting to type the server name into the `mstsc.exe` window? Not having to re-type credentials across connections?