229 karma · joined March 13, 2018
At least I know that Helldivers 2 (GameGuard), DJMax Respect V (XingCode), Fantasy Life I (EAC) do works on Linux.
I wish that if they're happy with non kernel mode anti cheat on Linux, just do the same in Windows... Or just disable them if I don't use public matchmaking
[1] https://github.com/Xajax/Xajax
While htmx reminds me of Adobe Spry Data [2] enough that I did a research into htmx and realize that Spry Data's equivalent is a htmx plugin and htmx itself is more similar to Basecamp's Hotwire. I assume there should be a late 2000 era AJAX library that do something similar to htmx, but I didn't use one as jQuery is easy enough anyway.
[2] https://opensource.adobe.com/Spry/articles/spry_primer/index...
Anyway as other commenters has said, the idea of htmx is basically for some common use cases that you used jQuery, you might as well use no JavaScript at all to achieve the same tasks. But that is not possible today, so think of htmx as a polyfill for future HTML features.
Personally I still believe in progressive enhancements (a website should work 100% without JavaScript, but you'll lose all the syntactic sugar - for example Hashcash-style proof of work captcha may just give you the inputs and you'll have to do the exact same proof of work manually then submit the form), but I've yet to see any library that is able to offer that with complex interface, without code duplication at all. (Maybe ASP.NET can do that but I don't like the somewhat commercialized .NET ecosystem)
The UI I think would require React is a wizard-style form with clientside rendered widgets (eg. tabs). If you can't download a library to implement that, it is a lot of work to implement it on backend especially in modern websites where your session is now JWT instead of $_SESSION that requires a shared global session storage engine. I'd imagine that if you don't use React when the user go back to the tabbed page you'd need to either implement tab switching code on the backend side as well, or cheat and emit a JS code to switch the active tab to whatever the backend wants.
I casually asked our account manager "Do you know any local customer with EB success story?" Their answer was "Do you want to be one?"
I don't think I ever found more documents on this feature. I assume it might need lots of users with matching result to ensure that bad actor can't upload malicious shader.
From my guess, Steam support Vulkan shader pre-compilation so that you don't have to wait in game (like the infamous 10 min Monster Hunter Wilds startup delay). They also seems to also be able to download the compilation cache from Steam if someone already have done the process on the same GPU + driver version. Since fewer Windows games use Vulkan this feature is often not used, but on Linux most games will run on Vulkan (esp. Proton games with dxvk) you may experience the process more often.
I shipped a project with Lit and I liked it, but I didn't like that I'd need to know the complete project scope up front that I could write everything from the ground up. I know I could use React component for some of the harder stuff but at that point might as well use React and avoid bundling two systems
Your privacy policy isn't good for a privacy focused provider though. You shouldn't have the rights to use my personal information. The use of Google Tag Manager also not inspire confidence, especially in LLM pages where you might "accidentally" install a user monitoring script and the prompts get logged. I'd suggest looking at how Kagi do the marketing to privacy-conscious customers.
They requires that for any transaction past 50k THB per day (not per transaction) you'll need to provide face recognition. This means banks need to develop its internet banking solution past Web 1.0 era. From what I know (and I didn't do much research) most banks simply just shutdown internet banking instead of complying with that, only business banking get a separate website. My bank they simply merge the personal banking and corporate banking into a new system, but you still need to approve the transaction on a push notification (and perform face recognition).
It doesn't help that I believe many online casinos and scammers are scraping internet banking and even mobile banking APIs. There was a bank that apparently you could find PHP classes on GitHub that emulate their mobile app, and when that was in the news people were saying that the bank doesn't have proper security even though to use the class you'd need to provide exact same information in the app itself. Scammers used those code to move money from mules to mules, obfuscating the money's movement. The banks doesn't talk to each other either, so once the money goes through a few banks the chance you could trace it is almost none.
There was a court case that the court have ruled that if you were to get scammed to install apps on your phone that scam you for money, the bank is at fault as they have improper security. So they're heavily incentivize to protect users from themselves.
As for facial recognition, disabled people sent letters to Bank of Thailand, as legally blind people are not compatible with the liveness checks, the bank apps do block screen captures and refuse to work when any accessibility services is on and all BoT says about that is "we already told banks to do something" and the disabled people just send a second open letter this week, as many banks did nothing, some banks probably have a backend account flag to bypass the checks but didn't train the branch agents to perform such changes on the account.
Also Thailand has move into cashless - most local people don't use cash now except for small mom & pop shops that are doing dodging tax. Of course credit card is not accepted (or with minimum) - Thai business owners doesn't like fee no matter how small it is.
So I moved to Dhizuku. It's a bit hard to setup, but once I'm done it's felt like untethered jailbreak - I don't have to complicated dance to start Shizuku now. Dhizuku basically make your phone a company phone, except it report to you. To setup a "managed main profile" you'd need to remove all accounts visible in Android account system and type a long ADB command so I don't think it can be maliciously done.
I suppose this will be how we'll use F-Droid in the next year for enthusiasts.
Basically to avoid the ambiguity of training LLM from unlicensed code, I use it to generate description of the code to another LLM trained from permissively licensed code. (There aren't any usable public domain models I've found)
I use it in real world and it seems that the codegen model work 10-20% of the time (the description is not detailed enough - which is good for "clean room" but a base model couldn't follow that). All models can review the code, retry and write its own implementation based on the codegen result though.
However, it is quite fun to remove the boring part in programming with AI, so any hobby code I write I won't be making them public.
Currently I'm working on a way to use models trained from MIT-licensed code (eg. Comma) by using normal commercial model to supervise it. I believe this make the output code only be tainted with permissive code, and so I can now slowly use AI to write open source code again.
I use PetrosStav/gemma3-tools and it seems that it only works half of the time - the rest the model call the tool but it doesn't get properly parsed by Ollama.
So far, the judge believe that training models on open source code is not a license violation as the code is public for anyone to read, but by "distribution or redistribution" (I assume, of the model's outputs?) it is still up for the court's decision whether that violate the terms of the license, among other laws.
The case is currently moved to Ninth Circuit without a decision in the district court, as there are other similar cases (such as Authors Guild's) and they wanted that the courts would offer a consistent rules. I believe one of the big delay in the case is in damages, which I think the plaintiff tried to ask for details of Microsoft's valuation of GitHub when it was acquired, as GitHub's biggest asset is the Git repositories and may provide a monetary value of how much each project is worth. Microsoft is trying to stall and not reveal this.
Like Mary, first daughter of Henry VIII
Most large websites are hosted behind a CDN or a load balancer, which terminate the TLS session and is a MITM between the customer and the actual backend server. The problem is similar to TLS Client Certificate - you can't forward these to the backend now, and the load balancer is not smart enough to validate the data so it is impossible to use it.
In recent years (~5 years), AWS ALB and competitors gained the client certificate support now which pass the certificate information to your application in HTTP headers - instead of a standardized way of reading client certificate the servers has to read from non-standard headers.
If passkeys is also passed as HTTP payload, I don't see believe that the LB would read the payload anytime soon. It might become a selling feature for IDP-as-a-service like Auth0 that you can't do it with IaaS.
- The account manager and the enterprise support TAM can view a list of all resources on the account, including metadata like resource name, instance type and cost explorer tags. Enterprise support routinely present a monthly cost review with us, so it is clear that they can always access this information without our explicit consent. They do not have the ability to view detailed internal information about it though, such as internal logs.
- When opening support case, the ticketing system ask for resource ARN which may contains the name. It seems that the support team can view some data about that object including monitoring data and internal logs, but potentially accessing "customer data" (such as ssh-ing into an RDS instance) requires explicit, one off consent.
- I never opened any issues about IAM policy, so I don't know if they see IAM role policy document
- It seems that the account ID and account name is also often used by both AWS' sales side and reseller's side. I think I read somewhere that it is possible to retrieve the AWS account ID if you know S3 bucket or something, and when exchanging data with external partner via AWS (eg. S3, VPC peering) you're required to exchange account ID to the partner.
Turns out it is pretty much required for a distributed system. A common question in microservice architecture is whether to validate permissions only at the API gateway layer, or at every points of use. If you want to validate it everywhere, what happen when you're running async job and the user get revoked. In Zanzibar you attach the cookie as the user's context and Zanzibar will always return the same answer. (This is not meant for cronjob where user set it once and it repeat daily, but rather for quick, one off background jobs like generating reports to users' email) If you remove the internal store, the application's API must provide point-in-time query, which I never see one application does that let alone a microservice environment.
Another problem is cache invalidation - when permission get added or removed, users want that to reflect quickly. I can't remember how the paper handle this, but in any case since the permissions are stored in Zanzibar, every changes goes through Zanzibar. If you remove the internal data store, you lose the change notification.
The pseudo-Zanzibar lives in production today, but I feel like it is one of the mistake in my career.
As for coding model my view is they're directly violating my copyright, especially that I checked some "open training data" corpus that it does confirm that my code is part of the corpus without honoring the license.
Fun fact from the MDM implementation - the most private way (at least to the company policies) to have a company-connected device is to buy a separate phone and install company's MDM on it. On company provided devices, the company may locate company's assets at any time but doing so on a personal device is a privacy breach.
I also think that private space do not fix the underlying issue. If you have four apps and you don't want them to know about each other you can put one of them in main profile, work profile, app locker and you run out of profile for the last one. The way app locker work doesn't scale to tens of sandbox.
The DHL shipping though I remembered it was $25 and it is still $25 today
F-Droid, however, allow the developer's binary to be reproduced if they have tested that the APK is reproducible when replacing the APK's signature with the original APK.
Now I use the unlimited plan and so I search first, spellcheck later. Or sometimes it corrects it for me.
- Always on. Garmin has option to do that as well but it reduce the battery life to like 3 days. In outdoor my Pebble Time is very bright with zero backlight.
- 5 days battery. I went on a trip to Japan without its proprietary charger, by the time I board my flight back it was on power save mode and it died the moment the plane landed. Garmin could do this if you set it to power saving mode, but the Pebble is in standard mode. One could argue that the Garmin do have more stuff like health monitoring that Pebble didn't.
- Cheap and no frills. I want a second screen for my phone, not a health tracker. Originally my Pebble Time shipped with zero fitness features, and it later added a step counter once it's clear that the market direction go that way.
- Garmin is quite thick, Pebble Time is thinner
- The UI is simple - press up for past event, down for future event (calendar). Press the middle button for menu. Hold are configurable. Garmin has 4 main menus which are very confusing (fitness menu, shortcut menu, apps menu, system menu).
- Lots of free apps and watch faces which I actually used (like a music app that show album art). I don't see any apps I would want to use on the Garmin, and they're mostly paid. The "hide in a hole while ceiling crush the map" game on Pebble was really well done. Now my Garmin use the simple time in Verdana watch face because I cba to find a decent one.
- Even with low framerates, Pebble managed to deliver cute little animations. Replying to message show a flying paper plane, screen transitions have suitable animations (not generic ones like Android), and the best one is muting an apps show a Ostrich putting its head under the ground. The animation also hides how slow the hardware actually is, with later OS versions stalling over a second or two after a second long animation.
- I think the phone app UI is not as good as say, Apple Watch, but it focus on apps and the store without the fitness features. Garmin's app is entirely about fitness and they hide smartwatch stuff in a menu plus another separate Connect IQ app.
Overall the PebbleOS feel like a really solid and polished product than any smartwatch today. It do fewer things than most smartwatches, but that's all I care about and everything it does is very polished.