dsl

I can write my own authenticator implementation in a few hours by hand, maybe 5 minutes vibe coded. https://www.rfc-editor.org/info/rfc6238/

Even if you throw your phone into a volcano and buy a new one, you can still receive SMS verification.

If you are blanket accepting permissions passkeys do nothing to fix the attack you describe (on device phishing).

Passkeys are not about securing things.

The entire value proposition, and the reason big sites are pushing them, is they take the user out of the loop of authentication. You are no longer authenticating the user, you're authenticating the users device.

For websites you don't have to worry about cookie theft and dealing with the support load of users needing their accounts reset or dealing with fraud. You can also do some level of attestation to hardware which makes automated account creation more difficult.

For the user it offers no additional benefits. You still have something secret that gets presented to a website to login. Password managers solved this problem. But now for some reason you can't log in when you buy a new laptop.

Warren Buffet made the largest single tax payment in US history last year. He doesn't play any games.

Telemetry is used to push service, which is the big money maker for dealerships. Roadside assistance, maps subscriptions, driving data for market research.

Selling it is pure icing on top.

I spent about an hour looking at the code and found some glaring issues that should be fixed before trusting it with real money.

- Yahoo News is introduced twice (sentiment and news analysis) which double weights it

- Sentiment analysis prompt primes the model to be bullish on Nvidia.

- In the self learning loop there is a complex parsing bug that results in hallucinated memories when agents return truncated responses

- You can completely control sentiment analysis of a subreddit by simply maintaining a majority of the 5 most recently posted messages, regardless of any quality metric

- The reflection prompt states the agent must cite alpha, which in a market wide downturn causes it to think correctly placed calls were losses

Authentication was never the problem, transport security was.

This is why we pushed to deploy TLS everywhere instead of focusing on a scheme to PGP sign every webpage on the internet.

That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then.

DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents.

We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.

DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions.

https://sockpuppet.org/blog/2015/01/15/against-dnssec/

I think the comment you replied to was referring to the fact that when Twitter was taken over the entire Trust and Safety team was done away with. This has allowed child sexual abuse material to flourish on the platform.

In naive implementations like Grok that is exactly what happens.

> but are they functionally useful or helpful to anyone currently?

I've been building a SaaS that deals with data that can't be distributed to third parties. Some of the useful AI stuff I can add is not time sensitive and can run overnight. Things like this allow me to use higher quality models without selling my house for GPUs.

Seeing as Apple is sunsetting a program that is far superior as a consumer, the two are not unrelated.

General compute is also the worst solution to the problem.

Nvidia's entire business is dependent on Google not being able to make TPUs fast enough.

Put simply government officials created a scheme to buy up a bunch of unused water rights, then use state and federal dollars to pay themselves incentives to continue not using the water.

Here is your easy solution:

Per employee tax = $0.20 * commute_miles * 2 * (commute_miles / 10)^2 * mandated_office_days_per_year * (1 + 2 * share_of_workforce_over_10_miles)^2

Tech companies can have more distributed offices and assign employees based on geography instead of teams, go back to WFH, pay employees enough to live close to their mega campuses, or pay out the ass into adding more lanes.

THIS IS A GRIFT.

Joel Ferry, the executive director of Utah's DNR retooled state laws to allow water right leasing and promoted HB187 which allows you to hold water rights without developing them.

He also happens to be a large shareholder in Bear River Canal Company and has been going around quietly buying up water rights from smaller canals and municipalities.

Grow The Flow is closely aligned with Great Salt Lake Rising (ran by the son of Mitt Romney), who plan to solve the issue ahead of the 2034 Olympics by buying up water rights from private owners. They committed $100 million of their own money, but got it matched with $300 million in state funds and a $1 billion budget line item from the Trump administration.

Be wary of environmentalism that is being driven by the wealthiest families in the state.

Criminal prosecution isn't even an issue because it does not extend to the executives. PG&E somehow keeps paying fines to resolve murder charges.

https://liberationnews.org/pges-rap-sheet-the-criminal-histo...

A webpage cannot provide a system I/O device (camera, microphone, speaker, etc.). That requires a signed driver on MacOS.

Heh. I built "Fusion" a few months ago as an MCP using OpenRouter. The idea was to give Claude a "panel of experts" to go talk to when it got stuck.

After extensive testing and benchmarking I discovered that when you ask one model to judge another's response you don't actually get a better answer. You are just asking it "how closely does this resemble the answer you would have given me." Additional rounds and all the "obvious" solutions that pop into your mind reading the proceeding sentence are essentially just cranking up the temperature.

I did find a solution, but it is insanely expensive. Maybe if this gains traction I'll release mine.

TLDR: Adafruit found out Flux was being dishonest about their user numbers. They also found and responsibly disclosed that they could get their Firebase keys by opening up Chrome's devtools.

> pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries

This is most likely OFAC. Lets Encrypt could apply for a license to do business with sanctioned entities, and given their use case it would most likely be approved.

https://ofac.treasury.gov/ofac-license-application-page

That is like saying you can't get a virus on your computer because Facebook doesn't allow viruses to be posted to the internet.

Differential parsing is a whole class of security bugs and they matter a lot. Take a look at HTTP Request Smuggling for examples.

Also, I am pretty sure there are more non-web x509 certificates out there than all the "browser trusted CAs" combined have signed. :)

You either die a hero, or live long enough to see yourself become Akamai.

The reason everyone came running when Cloudflare first started was obviously the "burn VC money to gain marketshare" but it was also the sheer simplicity. They had one product and a handful of features.

Until someone on the business side takes a step back and says "when I mouse over 'Products' on the homepage, why the fuck is there a 'See All Products' link" it will be impossible to have a usable customer experience. Start killing things and making them features.

> Yeah, but Google has the money for this. They are quite literally the most profitable company in the world.

"Alphabet announced that its 2026 capital expenditures are expected to be $180-$190 billion, and that it expects 2027 capital expenditures to significantly increase [...] over the 12 months ended March 31, 2026, Alphabet generated $174 billion of operating cash flow"

Compelling Microsoft to turn off your Office 365 at least requires Microsoft to be complicit. Sovereign infrastructure didn't protect Venezuela or Iran.

Which is just wildly backwards. It is the same mindset of the cyberpunk "privacy advocates" of the early 2000s, move your stuff to Sealand or Switzerland.

The fundamental flaw with this plan is if your fear is genuinely of the United States, your data is far more protected inside the US. The intelligence community has no restrictions operating on foreign networks and servers.

Rather than go to a FISA court for approval, we just hack your box and take your data. Or ask a European intelligence service to use the much more lax laws to compel its disclosure.

Yes, data collection happens on US soil. But ask anyone who has worked on the inside how much of a pain it is to view or process USPER data.

gLinux already exists. Its meh.

ChromeOS was honestly the best they could do.

The internet worked for so long because people responsible for each little island did what was for the most part in the best interests of the rest of the islands. If you didn't, other islands would shut off their links to you. Law enforcement was a last resort because 1. the courts don't move at the speed of the internet and 2. nobody wanted the internet getting top down governmental regulation because it was trans-national.

Cloudflare spent a bunch of venture capital to give away expensive things for free and buy market share. If you convince all the grocery stores to move to your island, you can operate a den of criminal activity with no fear of everyone else shunning you.

Talk to anyone who fights botnets, malware, or online scams. Once you hit the Cloudflare dead end you just have to give up. Law enforcement isn't going to take up a case where only 7,000 peoples computers are infected, and Cloudflare isn't going to investigate and take action themselves.

Yes. At this layer the OS has no say in the matter.