lima

Webpage is flaky, here's a backup: https://web.archive.org/web/20230517105311/https://blog.jetb...

A distributed consensus mechanism provides byzantine fault tolerance - which is helpful even with trusted actors, as this event demonstrates.

> Your bank and soon every other service will see how 'cheap' it is to fight spam and abuse simply by restricting accounts attested by [apple,google,microsoft] and nobody else, specially 'None' like this one.

If that's what they want, they can have it today via OAuth/OIDC (and many sites do just that). It's not a panacea - Google & Co catch some spam accounts but not all of them and not always before the damage is already done.

Passkeys/WebAuthn improve the situation by giving site operators more choices.

Beautiful example of the limits of AI - it simply reiterates the comment in a seemingly informative way, but it doesn't actually understand it, so it really just states the same thing but more verbosely. Knowing nothing about Passkeys, it's also subtly wrong.

What exactly is your point?

> and BTW you cannot get the photos out at the same quality as you put them in

You can get the original photos out, but they're either making it annoying on purpose, or just don't care:

- When you download a photo through the web UI, you get the original file, metadata and all, but there's no way of batch-downloading everything.

- Google Takeout will give you the original image and the metadata, but they store them separately, and make no effort to put them back together and you have to do it yourself using one of many third-party tools. Given that they have the code to do it, this feels very hostile indeed.

WebAuthn is a standard. From what I understood, can use any third-party authenticator like a YubiKey instead of Google's implementation.

Thanks for debunking this unfounded conspiracy theory.

There are many things to worry about when it comes to firmware backdoors, the TPM ain't one of them.

Same thing, different implementation language :)

Starlark is used in a number of production systems so there's good support.

Well-done parallax scrolling libraries do just fine with scroll wheels and no smoothing. This one just isn't very well done - I bet accessibility features don't work either.

You might also want to take look at Starlark, which has a Go implementation: https://github.com/google/starlark-go

There is no widespread use of end-to-end encryption beyond 1:1 chats and small groups.

Discord, Telegram, and similar platforms do not use end to end encryption. So I would read this as "we need to get even better at monitoring literally all public or semi-public means of communication".

Fun fact: It appears that Yandex uploads thousands of placeholders for every internal package name in order to prevent this from happening: https://pypi.org/search/?q=yandex+AND+%22dependency+confusio...

Surely that is not the only viable defense?

Whoa. They didn't even block the installs from continuing to happen.

Google must be really confident in their ability to contain threats like this one. In other orgs, this would be a "hair on fire" sev 1 security incident.

Who is "they"? The head of the agency? Their advisors? Individual employees? Politicians? Failure of this magnitude is almost always a systemic failure.

Actually figuring out who, if anyone, committed a crime (through gross negligience, willful obstruction, or similar) will take years.

The head of BaFin and their deputy were forced out over it and the agency is undergoing significant restructuring[1], and a new agency was formed specifically for investigating financial crimes[2].

In terms of actual liability - no, at least not yet. A number of lawsuits by individual investors were thrown out[3] but it's possible there will be public prosecution:

> Criminal prosecutors in Frankfurt are assessing whether BaFin employees obstructed justice by not properly investigating fraud warnings.

In the end, it's a regulator, they have to rely on auditors to some point. If Wirecard lies and EY doesn't catch it, that's on the criminal and the auditor. Still, it's hard to understate just how badly the agency fucked this one up... Hopefully, it'll serve as a true wake-up call.

Certainly seems like it - they have been more aggressive recently with other problem companies like N26, Solaris Bank, Coinbase, Deutsche and others.

[1]: https://www.ft.com/content/4f948457-678e-485c-92f7-2837064a5...

[2]: https://www.ft.com/content/587b6c52-c93e-4b2c-949a-53f6a1667...

[3]: https://www.ft.com/content/9fab6842-4ee6-4114-a35c-09bf9c62a...

Yep. Amateur radio operators couldn't care less about a pirate FM station, but will fiercely defend their own bands.

Our local ham community once got a foreign country to move their over-horizon radar off the ham bands by escalating it with the authorities until they raised a formal diplomatic complaint. Lol.

And rightfully so - ham bands are under constant threat of getting reclassified and auctioned off to the highest bidder. It's use it or lose it.

Right. Something like lit-html simply re-renders the DOM. This is essentially as efficient as it gets.

VDOMs were created precisely because the native DOM was too slow.

This is no longer the case and a tiny web component framework like Lit significantly outperforms[1] React relying entirely on the browser DOM and template literals for re-rendering... so what you're asking for, has already happened :-)

But even the big frameworks are really fast thanks to modern JIT JS engines.

[1]: https://www.thisdot.co/blog/showcase-react-vs-lit-element-re...

> Just think how many JS kBs and CPU cycles would be saved globally if browsers could do data binding and mutate the dom (eg: morhpdom, vdom, etc) natively. And the emissions that come with it.

Browsers are solving these real-world problems. With modern JS engines, frameworks are nearly as efficient as a native implementation would be.

And with web components, shadow DOM and template literals, all you need is a very thin convenience layer like Lit/lit-html[1] to build clean and modern web applications without VDOM or other legacy technology.

[1]: https://lit.dev

They will revolutionize the ability to find and fix vulnerabilities.

Threat actors can already afford expensive security researchers today. It removes some of the asymmetry.

Should've said "is spreading vaccine misinformation".

Haven't tried this one but Reviewable and Graphite. They're all very nice and yours looks nice also. The problem with all these third party SaaS-es on top of GitHub:

- You have to trust a random (no offense meant!) SaaS company with full access to your repositories, and to not disappear in a year or two.

- GitHub API rate limits end up causing issues sooner or later. For instance, Reviewable would randomly break and ask you to add more admin users so it could load balance API requests across multiple accounts!

- Likewise, you are still forced into the PR model and things that are trivial in Gerrit, like stacked diffs, are still hard. spr helps[1], but at that point you are piling workarounds on top of workarounds, might as well use a tool that supports the workflow natively...

- It gets messy unless 100% of the team is using it because then you have to somehow sync comments and approvals back and forth... And getting 100% of the team to use it isn't much easier than convincing them to use Gerrit, with all of the downsides.

[1]: https://github.com/ejoffe/spr

Probably not a coincidence - changes are the #1 reason of outages. Moving faster does mean breaking more things.

My company uses a self-hosted Gerrit instance. A bit of a learning curve, but the code review experience is SO much better than PRs (one commit == one unit of review, clean intra-diffs between different revisions of a patch, stacking of reviews simply by having multiple commits on a branch, UI is very snappy and responsive...).

Self-hosting Gerrit is easy[1] because all its internal state is fully transactional, including reviews and configs, and is simply stored as normal Git commits inside the Git repos on the filesystem.

In fact, our instance had much better uptime over the past year than GitHub despite being migrated to another server once!

[1]: ... unless you need a complex high availability setup or replicas. But 99% of projects are fine with just a single instance and backups.

Michael Yeadon - former chief scientist at Pfizer - is now an anti-vaccine activist[1]. Similar story with Robert W. Malone[2].

Former accomplishments or positions are not a good appeal to authority.

[1]: https://en.wikipedia.org/wiki/Michael_Yeadon

[2]: https://en.wikipedia.org/wiki/Robert_W._Malone

I think it's fair to call that a conspiracy theory.

> Stupidly simple and easy to host.

At scale, serving tens of thousands of users? Unfortunately not.

It's allowed in Europe and Denmark as well. Some µA of leakage current are acceptable.

Happens because of Y capacitor leakage in switching power supplies.

Big benefit of Advanced Protection: you can go tell less technical users to set it up and it will enforce all these best practices (no SMS, two keys, no giving random apps access to GMail...).

Still much less common to have that vs. a Paypal account :(