kenmacd

I'd much prefer companies actually follow NIST and stop using SMS for any type of authentication.

eSIM has the advantage of allowing me to switch to cheaper services without paying $10 and waiting for a physical card to arrive. Is it's security crap? Well so is the security of my mobile provider's kiosk minimum-wager workers.

> git his one linear history > Don't make me pick!

I'm not understanding what you mean... to me it doesn't.

For example you can browse by 'chapters' by adding `--first-parent` to your `git log`. You have commits, which are paragraphs, then you have merges (ie chapters), and you can view from either view, or many others.

I couldn't agree more. I've worked on multiple projects where PRs must be 'squash-merged' and I've never understood why people want to throw away history and make their bisects harder.

If you use proper merges you can always see a 'squash-merge' view of the repo. If you squash you can never see an individual commit view.

Also if you're required to tie changes to some ticket system—especially if you have to put that ticket info in the subject—then with merges you can put that ticket info just in the merge commit and the rest of the commits can have proper subjects with actual useful information in them.

It's not a new one, but also good to get the shingles vaccine if you're over 50. Even under 50 might be a good idea as cases—although still uncommon—are increasing in younger people[1]. (Unfortunately where I live they won't let you get it if you're under 50, even if you throw money at them).

From what I read it's thought that kids being vaccinated (a good thing) have reduced adult exposure to the virus, decreasing the immunity we received from being infected as children.

[1]: https://www.cbc.ca/news/canada/nova-scotia/shingles-under-ag...

> They’ll

What if I asked you to list all our source material that led you to use that particular contraction. Heuristics will not do, you must list each.

Can you do it? Do you believe AI should.

> I agree that it should be possible to implement

Those exact words appear in another forum post from 2006:

https://discourse.igniterealtime.org/t/cm-3beta-compression-...

Should you have quoted that as a source for your reply? What if we knew you'd read that post back in 2006, affecting your neurons, then should you?

It might not be too hard to imagine a simple case of a specific topic where you might have some more prominent sources, but even in those cases I believe if you think it through you'll find there was a ton of other sources that led to the weights that allowed you to 'know' the topic.

> I think generative AI should be able to provide links to similar source material in the training data

Except these aren't databases, so that's generally not possible, in the same way that it's not possible for your provide links to the source material it took to write your reply. How much learning led to the weights on your neurons that allowed you to generate that? Where did you learn about using italics and it's effect on how the words would be interpreted? Where did you learn the tone that would be appropriate in this particular forum?

> People should be able to opt out of having their content used for training

Okay... but then, if I write a book should I be able to opt out of you being allowed to read it? What conditions should I be able to put on who can read my work? Religion? Skin colour? People that aren't good at memorizing?

Hopefully the idea of putting limits on who can acquire knowledge sounds absurd to you. Why are those same limits okay if they're on 'what' rather than 'who'?

> AI companies are just trying to avoid lawsuits by keeping it secret

Which has created a barrier to further research. Instead of me and Joe being able to collaborate on research and papers using the same datasets, we now hide our training data lest the luddites come to smash the machines because learning is only okay if not done too well.

> TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin.

More convenient than yubikey webauthn, or just yubikey TOTP? Personally I find tapping my yubikey much easier than any 'enter the code' 2FA.

Also it should be noted that storing your TOTP secret in the same place as your password means you're one malware attack away from losing access to that account. While this risk may be acceptable for many accounts, it should at least be considered.

> due to security and version compatibility, I feel maybe it shouldn't exist anymore.

I've also thought similar. From a security standpoint though it seems like shared libraries are largely a win. Imagine you're running a bunch of services and a vulnerability is found in OpenSSL. With shared libraries you can update one package to be pretty sure they're fixed.

> There is not any version of this issue that isn't a particularly morbid form of the trolley problem.

Do you believe withdrawing life support is murder? What about a doctor following a patients do-not-resuscitate order?

If an accident causes someone to be decapitated, is transplanting the heart from the headless corpse still murder? What if it wasn't an accident but a beheading; who committed the murder, the person that cut off the persons head, or the person that transplanted the heart (or was the victim murdered twice).

> I’ll admit this article gave me some uncomfortable feelings over that fact.

Which part made you uncomfortable? Would it improve your comfort level if they started by cutting of your head?

> they at least need to provide multiple classes of Organ Donor

Places do have choices allowing donors to decide which organs, and you could make more specific wishes known in a personal directive. I'm not sure 'classes' makes sense though, as there's a lot of different variables that different people could think should be encoded in an organ donor class.

While I applaud the modularity here, I just can't get excited about a ICE vehicle from a company actively lobbying against BEVs.

There's at least a couple of reasons that your analogy doesn't really work.

First a lot of these roads are 'free' and yet you're still being charged for it. If two large networks come to an agreement then they connect the two networks (ie build that road), but no money changes hands.

Second if there is a paid peering agreement in place (ie say AWS had a cost to push your data out), that still wouldn't be billed to them in the way they're charging you. Instead they'd be paying for the rate of traffic at something like the 95th percentile of the max. This means that you could download a petabyte of data from them when the pipe isn't busy and cost them nothing, or you could download a gigabyte when it's busy and push up the costs.

I have an LG that's an inverter one. I agree though, don't buy a non-inverter model if you care at all about the quality of what comes out of it.

And for the above poster, +30 starts it, it plays a little tune when done, and then every maybe 30s afterwards for 2 or 3 times. Oh, and the turntable rotates at 0.1Hz so a mug's handle is facing the same way it went in after any interval of ten seconds.

And yet you didn't cite any of the reference material you used to post that reply, or any of the reference material that led to you having that opinion in the first place.

I'm not being flippant here. We all use massive amounts of reference material to even think the most basic thoughts. Expecting you—or an algorithm—to be able to quote or even know the reference material that let to anything you say is a pretty high bar.

That's a good question... I suppose it seems to me like they're trying to keep useful information locked down. Even though this bot isn't 'public', it's still feels a bit like they're an author saying they don't want their book in a library. Actually it's even worse than that because they want to pick and choose who is allowed to read their words.

I guess another way I see it is like the site has put a banner at the top saying I can read their content, but can't use anything I learn from it, and can't tell you or anyone else about anything I've read. I get that in this case the 'me' is an algorithm and not a person, but does that really matter? If I read a lot of info on welding and then offer a 'learn to weld' class, how much does that differ from what the openai algorithm is doing. (And if it is public, are these same sites going to welcome the bots? I doubt it)

It also seems rather reactive and not well thought out. To include a quote from an Ars article (which gptbot can't read):

> As a thought experiment, imagine an online business declaring that it didn't want its website indexed by Google in the year 2002—a self-defeating move when that was the most popular on-ramp for finding information online.[1]

Or a couple quote Stephen King on another site that gptbot can't read[2]:

> I have said in one of my few forays into nonfiction (On Writing) that you can’t learn to write unless you’re a reader, and unless you read a lot.

> Would I forbid the teaching (if that is the word) of my stories to computers? Not even if I could. I might as well be King Canute, forbidding the tide to come in. Or a Luddite trying to stop industrial progress by hammering a steam loom to pieces.

As I said, to each their own. I just would have expected a site like NPR, that lists it's mission as "to create a more informed public", to not take actions that work directly against that goal.

[1] https://arstechnica.com/information-technology/2023/08/opena...

[2] https://www.theatlantic.com/books/archive/2023/08/stephen-ki...

I really don't understand why sites would do this. To each their own, but it currently lowers my opinion of the site. I was disappointed to see NPR and Ars on the list.

Thanks, I should take a look. I've also been meaning to try DivestOS.

I'm certainly not holding my breath on more GrapheneOS support, as so few people care. I'm not entirely sure it'd be the right fit for me anyway. I'm currently using a microg setup with lsposed so I can patch out some junk in modern apps (like Outlook trying to be device admin), and this kind of hooking is not something GrapheneOS is interested in (a feature request I opened a while back: https://github.com/GrapheneOS/os-issue-tracker/issues/284).

As much as I'd love to run GrapheneOS—and in the context of the original post—I just can't bring myself to willingly give the Google ad-machine my money. I keep hoping another manufacturer will step up and drive support for their devices.

> The so called democratic process objectively sucks.

It's not the democratic process that's the issue, it's the first-past-the-post. Fortunately the party to win the 2015 election vowed: "To make sure that every vote counts, the Government will undertake consultations on electoral reform, and will take action to ensure that 2015 will be the last federal election conducted under the first-past-the-post voting system.", so it must be fixed...

>> git absorb will automatically identify which commits are safe to modify, and which staged changes belong to each of those commits. It will then write fixup! commits for each of those changes.

This looks like exactly what I wanted. Thank you!

Ty. I've seen similar in other tools, and I agree that it's super quick... unless you sign your commits with a key that requires a physical touch of a yubikey. Then it's <tap> <wait> <tap> <wait> for every commit that comes after the one you just modified.

Interesting project... in the hopes of maybe nerd-sniping you (or having someone tell me where it already exists), I'll tell you the story I'd really like a solution to but can never seem to find time to build:

I have 5 un-pushed commits. I missed a 1-line change to that first one. I add that one line change to staging (gitui/lazygit/whatever), then I want to `git commit --fixup=COMMIT`. Finding that COMMIT is always a manual process for me for two reasons.

First I have to find the commit to which it applies. This commit is almost always the commit that changed the same line, or added lines around it, or something similar. I guess you could say it's the commit with the closest proximity to the change I'm adding.

Second I have to find the hash of that commit. If I've since done something like an autosquash rebase then it'll have changed. I generally end up using the mouse to do a copy/paste at this point.

Why not skip the fixup commits and just rebase right then, you might ask. Well the commits are signed, and signing requires tapping my yubikey for each commit after that.

I would really like to be able to do something like `git commit --I'm-an-idiot-and-missed-this-so-please-apply-a-fixup-to-the-proper-commit`, and have it do the figuring out for me.

Correct me if I'm wrong, but I suspect this has the same issue preventing me from using it as does Bitwarden, namely: if I give you my vault and my password, you can access all my passwords.

With how common hardware security keys (or even just tpm2) are these days this limitation seems inexcusable to me. Which is why I'll stick with gopass/pass using my yubikey (w/ touch policy fixed). You might hack my machine and trick me in to decrypting a few passwords, but at least you won't make off with them all.

> e.g. phones, mail.

What about all the in-person conversations. Seems those might be considered just a bit more traditional than phones conversations, and haven't been subject to those same search warrants.

> So what we're saying is E2E apps are more important than current law we have, and we want to invalidate the ability of the police to investigate crime. > > How can that make sense?

(*proposed* British online safety legislation)

Let's expand on that then: how can it make sense what humans can have in-person conversations that are not subject to search warrants. These e2e-private-in-person conversations prevent the state from investigating crime.

If police should be able to always access your digital information, would you support the same in the case of non-digital information. Should building codes be updated to require microphones be installed in very room?

If you're not in support of microphones in every room, then please tell me why the conversation between two parties, be they lovers or criminals, should lose it's ability to be private the moment it crosses the internet?

While containers solve a lot of problems, they do create a bunch of new problems. For example that 'every dependency' is a double-edged sword. Now instead of just one version of OpenSSL on my host I have a bunch. Half them are vulnerable, and none of them share the same memory.

Personally I'm looking forward to when this is included in Nix so I get a ephemeral/reproducible install that doesn't add a second copy of both postgres and ngingx.

Well, in case you decide to move back, give Sidebery a try. I switched a while back haven't had any issues.

Wait, are you me? I tried to convince musl to not break in this case (https://www.openwall.com/lists/musl/2022/12/04/1), but mostly got a "we're right, cloudflare's wrong" answer. Tweeted at Cloudflare about the issue (https://twitter.com/KennyMacDermid/status/160055878578481971...) and never heard back. I really don't care who's right, and can't change who's using Cloudflare+DNSSEC, so instead I just don't use musl.

[Previous comment](https://news.ycombinator.com/item?id=35058094): ---

My personal 'musl broke it' story comes from resolving domains from Cloudflare that use DNSSEC in a K8 cluster. Basically this:

  - K8 sets container to use `ndot:5`, causing the search list to be used
  - Musl walks that search list looking for domain
  - Cloudflare does not set the NXDOMAIN flag on a DNSSEC domain but does include an NSEC record (if you query with the dnssec flag).
  - Musl takes this 'NOERROR' reply and returns an EAI_NODATA.

Is Cloudflare wrong? I don't know, maybe. They say some things about the standards[0] and that it's technically 'right'. I don't see why they couldn't change the behaviour for queries without the dnssec flag, but I digress.

The issue is that every other libc I tested will continue searching and actually resolve the domain. Musl is the odd one out, and _only_ in the case where the search list ends up with domain using Cloudflare and dnssec.

Even if Musl is 'right' here, when it disagrees with major implementations and a major DNS nameserver does it really matter?

[0]: https://blog.cloudflare.com/black-lies/ ---

> The real issues are bootloaders which cannot be unlocked

I haven't run in to that lately, but an issue I find much more annoying is the lack of support around re-locking with a custom root of trust. I think a few others support it, but I've only seen mention of it on the Pixel phones (and I won't buy Google hardware after they wouldn't replace my Pixel 3 that was bricked by their EDL hardware issue).

I miss Particle's mesh support. It worked great for me in my tiny environment. I tried to get a thread border router running using zephyr on a xenon with the ethernet featherwing, but couldn't get it working.

I would think so. I've tried to do 'feature' groups of options, but without any way to do optional includes I gave up on that idea.

Maybe I'm just doing it wrong with just trying to add the dependencies I want. It might work better if I used the menuconfig GUI. To me though it seems if I decide I want to enable 'CONFIG_NET_TCP' on my project, I shouldn't also have to specify 'CONFIG_NETWORKING'.

As for why it works better in the kernel, that's a good question that I don't know the answer to as it's been years since I tried to build a kernel with a minimum configuration.