callahad

Looks like similar coverage is available at https://www.ancientcontent.com/p/the-wardrobe-in-house-ix-11, which also has links to some primary sources (in Italian) at the bottom of the page.

Not a PHP dev, but it seems calling `extract` is itself potentially insecure. The php docs warn against it (https://www.php.net/manual/en/function.extract.php):

> Do not use extract() on untrusted data, like user input (e.g. $_GET, $_FILES). If you do, make sure you use one of the non-overwriting flags values such as EXTR_SKIP and be aware that you should extract in the same order that's defined in variables_order within the php.ini.

Looks like calling it can shadow previously defined, unrelated variables?

Edit: On re-reading your comment, yes, if $requiredHeaders is previously sanitized then the code is technically safe. But it still presents as an insecure coding practice.

Check the "Freedom of Panorama" article on Wikipedia: https://en.wikipedia.org/wiki/Freedom_of_panorama - lots of restrictions around the world.

I believe koverstreet is referring to the Linux kernel Memory Management subsystem (https://docs.kernel.org/mm/index.html)

They've absolutely both changed. The initial version I saw didn't include max effort data points on the first chart, and the plot itself was much less favorable to Sonnet at high/xhigh relative to Opus, but the new chart shows them as closer competitors. Weird.

It's a silent technology, but I'd argue it has broken through in that most of us already use it daily without knowing. Figma, Google Sheets, Disney+, Prime Video, and much more all have WebAssembly somewhere in their stack.

Can you say more about what specific things you tripped over with Starling, and which bank you moved to? Worried I'll find myself in the same boat.

It does seem like Starling has gone out of their way twice to exempt GrapheneOS from their checks, but only after users complained: https://github.com/PrivSec-dev/banking-apps-compat-report/is...

Step 5.2; the browser binds the KB-JWT to the site it's on, so Site A would receive a JWT that is only valid for Site A.

> This section could easily be done by [...]

Less easily than you'd think.

You'd have to make an authenticated cross-origin request to the issuer, which would be equivalent to mounting a Cross-Site Request Forgery (CSRF) attack against the target email providers.

Even if you could send an authenticated request, the Same Origin Policy means your site won't be able to read the result unless the issuer explicitly returns appropriate CORS headers including `Access-Control-Allow-Origin: <* or your domain>` and `Access-Control-Allow-Credentials: true` in its response.

Browsers can exempt themselves from these constraints when making requests for their own purposes, but that's not an option available to web content.

> I'm guessing that this proposal requires new custom browser (user-agent) code just to handle this protocol?

Correct; which is going to be the main challenge for this to gain traction. We called it the "three-way cold start" in Persona: sites, issuers, and browsers are all stuck waiting for the other two to reach critical mass before it makes sense for them to adopt the protocol.

Google could probably sidestep that problem by abusing their market dominance in both the browser and issuer space, but I don't see the incentive nor do I see it being feasible for anyone else.

I largely agree, but I still think there's a compelling argument that blinding the issuer implicitly precludes API gatekeeping or censorship. Sites wouldn't need to pre-register with any issuer, nor could the issuer refuse to provide tokens on the basis of where they'll be used.

The key mitigation is that the protocol - as envisioned - is mediated by the user agent; you as a website cannot silently fire off probes that tell you anything.

The Verified Email Protocol got renamed to BrowserID, and Persona was its reference implementation.

This looks broadly similar to that, but with some newer primitives (SD-JWT) and a focus on autocomplete as an entrypoint to the flow. If I recall correctly, the entire JOSE suite (JWT, JWK, JWE, etc.) was still under active iteration while we were building Persona.

And hey, I applaud the effort. Persona got a lot of things right, and I still think we as an industry can do better than Passkeys.

For historic interest, the Persona After Action Report has a few key insights from when we spun down the project: https://wiki.mozilla.org/Identity/Persona_AAR

My understanding from looking into this two years ago is that it's hit or miss for banks (depending on if they opt into device attestation stuff), no for NFC / Google Wallet, and yes for Uber / Lyft.

Apparently the common workaround for the Google Wallet stuff is to pair a GrapheneOS phone with a stock Android smartwatch.

Edit: Here's some additional information on banking apps: https://privsec.dev/posts/android/banking-applications-compa...

Apparently the common recommendation these days is to use Curve Pay as a virtual card provider on GrapheneOS, which can then route to arbitrary underlying cards. And evidently Google Wallet does work for things that aren't payment cards (airline tickets, transit passes, etc.) on GrapheneOS.

For me, it was the challenge and allure of doing something relatively difficult and rare. The first time I saw a Stop - Prevent Your Death sign[0] at depth, I knew I wanted the training to go beyond it.

It's also really peaceful underground.

Amusingly enough, I can't handle blue-water or wall dives (vertigo), nor wrecks (those aren't supposed to be there!), but caves are no problem. You've got walls, floor, and ceiling as a frame of reference, and everything is nice and cozy. It's like the Earth is giving you a hug.

[0]: https://commons.m.wikimedia.org/wiki/File:Vortex_Spring_cave...

I found Florida's caves positively delightful at 21 C; never felt the need to dive dry.

I am envious of the speleothems in Yucatán cenotes. Florida's caves are all phreatic, so you don't get any real decoration beyond scalloping. Still fun to dive, just not much to see aside from water, wet rocks, and a line. And not even that if you blow the viz.

It's the Online Safety Act. As the government says about the OSA:

"Ofcom is the independent regulator for Online Safety. [...] Ofcom has strong enforcement powers"

https://www.gov.uk/government/collections/online-safety-act

Okay, so what does Ofcom say?

"It doesn’t matter where you or your business is based. The new rules will apply to you (or your business) if the service you provide has a significant number of users in the UK, or if the UK is a target market."

https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...

Cassidy Williams recently published an open source calendar that might scratch that itch: https://pocketcal.com

Source at https://github.com/cassidoo/pocketcal

Interesting that Apple even allows ICEBlock on the App Store given that 13 years ago they blocked the publication of an app that notified users of American drone strikes abroad as "objectionable" content: https://www.aclu.org/news/national-security/apple-drone-stri...

I disagree that LLMs are comparable to a higher level language or framework since the fundamental output it still at the same level of abstraction.

This isn't C to Python, it's Python to more Python faster.

> I don't know if that means an Apple server actually listens for the notification from the HTTP server or if the device itself maintains the connection to the server.

In the case of Apple's ecosystem, the device maintains a connection to the Apple Push Notification service (APNs). The website POSTs notifications to APNs, which forwards them on to the user's device. The user's device then wakes up a local Service Worker for that website in order to process the incoming payload and display a notification.

Declarative Web Push makes the very last step unnecessary.

(It's the same on Android but using Firebase Cloud Messaging instead of APNs. Mozilla also runs a push service and its source is at https://github.com/mozilla-services/autopush-rs/)

This covers binding Cmd+Opt+[Arrows, F, C], which is all I use:

    defaults write -g NSUserKeyEquivalents -dict-add \
        "\033Window\033Move & Resize\033Left" "@~\\U2190" \
        "\033Window\033Move & Resize\033Right" "@~\\U2192" \
        "\033Window\033Move & Resize\033Top" "@~\\U2191" \
        "\033Window\033Move & Resize\033Bottom" "@~\\U2193" \
        "\033Window\033Fill" "@~F" \
        "\033Window\033Center" "@~C"

Equivalent to manually binding in System Settings -> Keyboard -> Keyboard Shortcuts -> App Shortcuts

Same branch as beta, but with different build flags. Add-ons don't need to be signed to be installed on DevEdition, there's a DevTools button in the toolbar by default, etc.

FxOS at its height was an absolutely huge resource and personnel commitment; I seem to recall it being half of MoCo, maybe more.

Mark Mayo, then SVP Firefox, was quoted in a 2017 interview with Walt Mossberg:

> Mayo says [FirefoxOS] took the focus off of Firefox. “It was close to a bet-the-farm effort”

Cite: https://www.theverge.com/2017/1/25/14376710/walt-mossberg-mo...

You're probably looking at half that (~80 MB) per album for how normal people would've been ripping twenty years ago, so around 40 GB for 500 CDs. Contemporaneous forum post: https://www.head-fi.org/threads/comparison-compression-setti...

Thunderbird is housed in MZLA Technologies, an independent subsidiary of the Mozilla Foundation and completely separate from the Mozilla Corporation or its CEO's remit.

Didn't expect to click on that link and end up on a blog post I wrote 10 years ago! The old Firefox Sync / PAKE stuff was fantastic for getting sync going between devices... but people wanted backup, not sync. I wonder if we'd do anything differently confronted with the same challenge today.

I think it's worth jumping in. Fifteen years ago, it wasn't clear whether Git, Mercurial, or Bazaar would win, but it was evident that something fundamental had forever changed in revision control systems.

Nix feels similar, but for build systems, package management, and configuration management all at once.

Edge and Safari have had vertical tabs for years; when the default browsers on Windows and macOS offer that affordance, it becomes more of a mainstream parity issue. Which is thankfully, finally, being addressed.

It's a stereoscopic camera, so you get depth and such.

IMHO, it's still a few years a early for pure-play Wasm solutions, though Fermyon is doing exceptional work to manifest that future.

My hope is that Unit can offer a pragmatic bridge: run your existing applications as-is, and when you want to sprinkle in some Wasm, we're ready. That's not to say Wasm is Unit's only use case, but do believe it's what will get people thinking about application servers again. :)

> my Python apps have not been behind Nginx for a long time, they're mostly wrapped in a zero-config gunicorn runner in a Docker container, static assets in S3 via a CDN

...and are there any reverse proxies, load balancers, or caches on the network path between your end user and your container? ;)