buddylw

I would say its something you have when it’s hardware backed, including secure enclave/pin/face id, but a cloud sync’d password manager isn’t necessarily that, though, again still a better situation than a phished password.

A few examples here to illustrate... The way ebay and Amazon handle this are great. Multiple passkeys allow login of multiple device ecosystems and/or hardware tokens so that users can mange their own level of risk and really any level of implementation is helps the average person.

Meta's implementation by contrast is bad, in my opinion. You are only allowed one passkey (so one login ecosystem/hardware key allowed) and it completely bypasses 2fa and security tokens. So, someone looking for more security must avoid passkeys "altogeher" and use password + U2f security key and the passkey only being allowed in a single ecosystem means that password/phishing lanes must remain open. All you're doing is disabling 2fa on a key that is likely sync'd to all of your devices. All that said...it may still be a security improvement for most users in the real world in practice, I just find it a very annoying and confusing set of security decisions.

It moves the attack surface to password managers, which is arguably a better situation than phishing. I'm skeptical that the war is over, though. I have no proof to back this up as phishing is the low-hanging fruit today, so the numbers 'largely' back you up. I personally include device compromise in my threat model and I'll concede that may be overdoing it for the average person.

Passkeys only make sense if multiple passkeys are supported. What if I lose my Fido key? One issue here is that passkeys don’t have a clear role. If they are replacing passwords, only, then they are 100% an improvement even when not hardware backed, but you still need 2fa. If they are hardware backed, you probably don’t need a second factor and different sites see different roles. Assuming I can setup a backup key, hardware backed covers all of sites’ misconceptions, though.

I have one as a watch bezel that I use in a pinch. Anything you need to scale, divide, or multiply in the real word doesn't need more than 2 significant digits of precision so it works. For example, I've used it to calculate how many grams of coffee will give me a 1:16 to the amount of water/coffee I want.

This problem isn't going until we find a better solution to scraping than using your IP address as a passport.

I have a Swiss Micros DM42, a modern clone of the HP42s on my desk and I have the plus42/free42 app on pretty much every device I own. Stack based calculators are great because the stack works as a little scratchpad when I'm trying to figure something out.

If I'm solving a problem of any complexity I'll move to a more appropriate tool like python or a spreadsheet, but for the simple math that needs to be done around the edges personally and professionally, I like a calculator. If I'm at my desk, I'll use the physical version.

Bluesky is far from perfect, but I think you need a realistic comparison to other social media networks. Twitter is far more toxic if you are unable to curate your feed. Mastodon has a nice community, especially for tech, but lacks breadth.

There is a core group at Bluesky of people that left Twitter and they have an obvious slant, but I really don’t see this issue making the network worse than any other and only requires you to curate your feed like you have to do on every network.

No one said morality was easy.

Well, there’s one thing I know didn’t cause this: an IPv6 DDOS attack. GitHub, in 2023, is somehow still immune to all IPv6 attacks

If they add ipv6 support I’ll forgive them, but I lost hope a long time ago. It’s almost comical now.

I don’t really like this view of the world. I think they are correct about the lack of certainty and doing things while you can, but often big goals, like having a child, professional success, monetary success, etc. can cause us to miss life, too. Everything is a trade off. There’s always opportunity cost and you can always look back and see what you may have sacrificed to get where you are.

It’s needlessly depressing to wallow in this mindset. I personally value being a good person and my connections with people. Sure I could focus this energy on one human I bring into the world, but that’s not objectively better than anyone else I affect positively.

And I know having a child is a transformative experience. I’m lucky enough to have lots of little cousins and Have volunteered with programs for kids for years. Kids are amazing and bring magic to the world as you grow older. I just think that wrapping all of your identity and self worth up in a single goal is asking for disappointment. It’s not fair to you or the child.

Try to appreciate your real impact on the world. Did you improve someone’s day today? Did you restore someone’s faith in humanity? Is someone comforted right now by their trust in you? That’s the good stuff. Make that happen any way you can.

If you do want a child, go for it. Time IS ticking, but if you can’t or didn’t or are considering bring one into a bad situation or relationship to quell an existential fear, don’t worry. It’s fine. You can still find meaning and have an impact through your connections with others.

It’s possible, but I doubt they willingly sold their credentials. It’s more likely that they were scraped by some other means and sold.

I really like having totp functionality. I use a yubikey for TOTP and boot into an air gapped machine with keypass to store the TOTP codes in case I lose or break the yubikey. I don’t store TOTP codes in my main password manager, but it’s not completely insane. You’re screwed if someone gets your decrypted password database, but you’re still protected from most other attack vectors.

I read much of my waking hours for work, entertainment, and personal growth. It just isn’t usually (for better or worse) in the form of a book.

I’m not going to pretend I know the future or anything, but I will say that, while this is a common series of events, #4 can absolutely go two different ways. Everyone loves a good underdog story, but I also wouldn’t say that winning is the most common outcome.

Security has always been relative. I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars.

It keeps them closely guarded and selective about use. All of that makes me an unlikely target and reduces individual risk.

When I was in highschool in the late 90’s, I was really into exploring networks and systems I wasn’t supposed to be in, but it was always about learning technology for me. I found this tool to be extremely creepy.

I discovered that my local ISP had the finger port open on their dialup gateway. Since usernames were first letter + last name I could look up any ip addresses I found in my local firewall logs basically by name.

I saw someone trying to connect to this port and knew exactly who was scanning for this and eventually found a honeypot listener that would allow attackers to connect, but let you control the data sent back. I can’t remember exactly what I sent, but I called out the attacker by name when he connected to my machine and he never scanned me again

I recently made this realization and that eBay is actually better. eBay doesn't want 30% of the sale. I can order one item at a time prices are generally lower and, imo quality and risk are the same.

Wacom tablet drivers have application specific settings for compatibility. We should scrutinize all data collection, and this may be too far, but "[no need for tablet data collection] at all. Ever" is simply not true.

Wacom has application specific settings for compatibility. You can't have that feature without tracking individual processes and that data would be important for any sort of troubleshooting. It should be anonymized and they should be clear about what they are collecting, but the data does have a legitimate and benign use at least.

I'm getting ready to go full Battlestar Galactica in all of my appliances. It's now difficult to find high end washers and ovens without these features.

At least right now we can choose not to connect the devices, but what happens if iot LTE connections get cheap enough that the choice is removed altogether, like with Tesla and other high end modern cars?

I don't think I'm just being a Luddite. This really seems like a bad idea. We need some way to assure security and limit data collection.

Holy. Talk about nostalgia -- I used to read these all the time when I was a kid in the 90s. I had no idea the internet Oracle was still around!

I actually think there's real potential for these services, especially among kids in the enthusiast gaming community. I don't necessarily think we'll be throwing out our PC's for stadia, but I think there is a market if someone can deliver a cost effective product.

A bit ago Fortnite went from requiring DX 10 to DX 11 support in Windows. Kids with old hardware were devastated. Out of nowhere they couldn't play their favorite game until they saved up for a new video card, or worse, an entire laptop. PC gaming is a really expensive hobby that's completely out of reach for many.

You can point to consoles as a lower cost answer, but $400 is still a lot of money for some people, and PC gaming is still preferred by many enthusiasts for the keyboard/mouse experience and the ability to multitask with Discord, Spotify, etc. Consoles are closing that gap in functionality, but they aren't quite there yet.

Some people were saved in the above fortnite situation by GeForce Now, a competing service to Stadia that's been around a while. You can pick at the technical problems with streaming games vs PC, but at the end of the day, kids with reasonable internet that signed up were able to play fortnite in their PC's again. It solved a real problem.

If you add to all this the fact that so many kids interact with the world through a Chromebook or iPad issued by their school, one can see a world where a stadia gaming app or a GeForce Now app is their most convenient gateway to big games.

Stadia could still flop if Google doesn't develop and promote it properly, or if people aren't willing to pay enough for the service. I do believe there are people that want stadia, though, and outside of slow internet connections, I don't see why the sharing economy can't extend to gaming PC's.

If they aren't considering human lives in the process, that may be the real problem.

I do not pretend to know his motives. All I can see are his actions.

We can have a discussion about weather we should have billionaires in the first place, but Gates is employing his vast resources in an attempt to improve the world with a humble data-driven approach to reduce suffering in the world. For that, I'm quite thankful.

I agree there are big differences between these ISPs and Amazon. I was just making the point that Amazon's lack of a profit wouldn't exempt it from these regulations either. Profit is as much a bookkeeping/tax/business policy as it is an actual market signal.

Why do profit margins matter at all here? It's only a signal that there is a problem if margins are very high because there is no guarantee that an entrenched monopolistic company will be efficient or make a strong profit.

If you want to do a comparison compare consumer internet cost vs performance to places with a healthy and regulated market for internet service.

Also, by this logic Amazon could never be regulated. It doesn't make sense.

It still exists for one.

I miss vine.