coaksford

What is the "this" that we get through by disclosing unpatched vulnerabilities that aren't evidently being actively exploited in the wild before the vendor can release patches? I'm trying to be charitable and figure out what that could refer to and drawing a blank.

"...if attestation is the thing you're worried about, the post's own recommendation pushes you towards attestation rather than away from it!"

It is plainly obvious that the worry isn't attestation per se, it's the restrictions that attestation may in the future require when they turn the dial on restrictiveness up, that was extremely clear to me from reading the first article. If you can get attestation without those restrictions, "sure, why not", and a Yubikey seems like a way to do that which could avoid those restrictions. Most of this article makes sense, but this particular line makes me wonder how the author got it so far off the mark.

They also did nothing to quell my fears that they will in the future use passkeys to prevent people from using software they can modify themselves by saying "...the guidance for consumer sites has been to not even request attestation for years now." as if everyone always followed the guidance, and as if there aren't tens of thousands of managers that think their case is special and they really do need the extra control because they're a bank or handle copyrighted content or have PII or PCI and feel extra risk-averse today.

I don't know if they failed to do so because they can't (and this is a valid fear of the original author) or if they just are bad at reading the room at what the concern is and vastly overestimate how much people trust companies to always have their best interests at heart.

What I am getting from this, though, is "If you authenticate with a yubikey then that's attested, so they can't use attestation through passkeys to make sure your OS and browser aren't modified", and I'm not sure if that's the correct take away or even a correct statement.

At some point you don't want people to enter the bee movie script, but where the word "bee" was replaced with the entire bee movie script again, recursively three times, all into the password field and tie up servers with extremely long requests.

But 20 characters is simply ridiculous.

All my worst experiences with password length have been banking and finance and it boggles my mind that they all get something so incredibly basic so incredibly wrong. What is it about this sector that makes it so?

This isn't categorically true either, the real world is delightfully complicated, far more so than you imagine. The way cars interact within a road, as they enter an exit the road, or how they choose their route can all create conditions where adding a lane only makes traffic worse and can reduce both speed and volume during peak traffic hours.

Whether you mistrusted and were betrayed by that trust is binary, but that's like if someone says "radioactivity is a continuum" and you say "I either got hit by a gamma ray or not" as if that settles the question. Really the question was more like "what's the mean time to betrayal?" or "how big of a payoff can someone be trusted with before they have a 50% chance of betraying trust?" or "am I more or less confident that this person can be trusted in this situation?" or any of a dozen other obvious ways that people who seriously consider the issue of trust do so. If you think the binary states are absolute trust and absolute paranoia and there is no in between (as having any in-between makes it a continuum) then you've got a conception of trust that nobody else in the world finds seriously useful.

It could be that the Gimp team and community are so self-selecting, defensive, and idiosyncratic that they drive everyone else who wants to change (read as "improve") it out of the team and community before letting them do anything to fix it. Gimp stands out among applications I've used as having enduring bad UX for decades, and it's hard to imagine a reason for it other than that efforts to improve it are unwelcome. Even Blender, which I once thought was the only thing worse than Gimp, has successfully turned that around. The reputation that Gimp has for its poor UX is not a random coincidence that a cursed meteor struck it of all open source projects, it's an enduring social problem with exactly that team and community that has earned it that reputation. This enduring social problem won't be fixed by this attitude of "we want it a certain way", that's just defensiveness displacing the critical thinking that was actually needed all along.

The suggestion to fork it is in bad faith. A fork goes nowhere unless a critical mass of the development community goes with it, and if you've already driven away the critical mass that could sustain a fork, that can never happen. Don't worry, Gimp is safe, I don't think anyone organized enough to fix its problems thinks it's worth the effort anymore, they're all working on other things instead.

As someone who very reluctantly fits that description, yes but no. I don't love FreeBSD any less or want to use it any less than anytime in the last 20 years, nor do I like Linux any more than at any time in the last 20 years (less, if anything). But NixOS is the "killer app" that has me on Linux instead of FreeBSD. If either FreeBSD gets a really good NixOS-like setup, or Linux-based NixOS becomes unmaintained, I'm happily going back to FreeBSD again, it has always been excellent and stable to me.

If they can get what they want from this, they will not stop after they get it. Even if the authors of the law want it to stop here, their successors will not, and will build upon this to erode privacy. When governments can change the deal effectively unilaterally, as is the case, you cannot make a deal with them that they cannot change, and you will have already surrendered the strongest argument against the next "deal" they want to unilaterally impose. Do not treat this as a deal to prevent further erosion, that is not what this is, treat this as an attack and attempt to advance against privacy and anonymity. Treating it as anything else is absolute gullibility.

I have never used Oh My Zsh, but I use Atuin to do this and it works excellently at that. You can even make it filter by what folder you're in and whether you want to search only this session or host (you can sync shell history across hosts). It never occurred to me that this is something I'd want from a shell prompt, which is what Starship is.

BSD was mired in the uncertainty of a lawsuit over some of their code at the time that Linux was getting started, and the FUD around that gave Linux a head start that BSD had up until that point, so you can't infer much about the reasons Linux's early success over BSD through that fog. If Linux had been dealing with the same problem that BSD had instead, BSD almost certainly would be in Linux's place right now.

Before the AI craze, all the GPUs were being bought up by cryptocurrency miners, and I'm not sure that's better. Even as an AI skeptic I think AI is a better use of all this hardware than cryptocurrency.

I wasn't sold on face ID until winter, and then the appeal become viscerally obvious.

Don’t worry, it wouldn’t replace your human boss, you’d just have both bosses.

I think the meaning was not "You can import used cars without tariffs", but "If you buy used cars already in the country, you don't pay the new tariff, so just don't buy new cars."

It seems shaky trying to apply labels like "low level" or "high level" to Rust, it covers a very broad range of these "levels", just short of C and Zig on the low level end (at least, without becoming substantially less ergonomic), and just short of Haskell at the high level end. Rust definitely gets more attention for its low level characteristics where its safety features set it apart from its peers in that space, but it's still suitable outside that space, just less distinctively suitable, and so less widely discussed.

Some other languages will certainly have more developed ecosystems and frameworks available, but the purpose of things like Dioxus is to provide that. Instead of trying to put things into boxes with labels and deduce from there, you'll get more insight from trying it out and seeing where it works and where it actually struggles.

Because you're looking at a thread about Mozilla, the outrage is in the threads about Apple removing ADP for iCloud users in the UK.

They had two paths to comply with the law. Silently backdoor the worldwide cloud serving every Apple device, or loudly tell people in the UK they don't get to have security because their government prohibits them. Between these two options, this is clearly "making a stand".

It's not as much "making a stand" as telling a major government that you have substantial seizable assets under their jurisdiction who is a major market you want to be in, that you're not going to do the thing that their laws say you are required to do, but it's hardly simple compliance either, instead of doing what the government wants them to do, they are making sure there is blowback.

Whether to try to fight it in court likely depends on details of case law and the wording of the laws they'd be contesting, I imagine much of the delay in their response to the demand was asking their lawyers how well they think they would fare in court.

Thank you! Now that I know what the feature is even called it's much easier to learn about, definitely adding this to my config file.

As unhelpful as the other commenter suggesting atuin was, this is actually a thing that atuin does well, if you're using a shell it supports, it commits to history immediately.

I'm an atuin user and if this feature exists, I have not seen it and would love to have it. Could you expand on how to get per-directory history as something separate from global shell history?

No, Rust gives you a lot to wrap your head around very quickly, and it took me three or four epiphanies to get it, and I tried to learn and stopped twice before I was able to get far enough along with it that it became easy to think about and work with. It doesn't make you bad programmer, but I'd still suggest giving it another shot every 6 months or so as your time allows, and see if you're getting farther each time. As long as you're still learning each time you bounce off of it, it was probably time well spent, most Rust concepts will show up in other languages, and the ones that won't are still useful paradigms to be aware of so you can contrast it with other paradigms as you get more experience with those.

I love exercises like this because it sometimes forces me to reformulate ideas I've had abstractly until I'm happy with them.

1. Don't assign to categories that which can be described through traits. Do not put things into "buckets" when it is possible to describe them by a collection of properties that they can have to varying magnitudes. The real world is a messy place, far too messy for buckets, and the more you can do this, the more flexible your mindset will be for what it throws your way.

2. All judgements are based on values, but others' judgements only matter to the extent (read "extent" as one of the varying-magnitude properties above) that they share your own values. You can't and won't please everyone, don't accept their attempts to shame or guilt you when you're living your values, their values are not more correct than yours.

3. Imagine a better version of yourself. More reasonable, more empathetic, more charismatic, more articulate, more expressive, a better negotiator, less impulsive, less abrasive, less arrogant, less cruel, etc. You choose what the better you is like according to your values, but these are some of mine. Strive to be this version of yourself whenever you can. Be on the lookout for cases where you are less successful than you expected, see where a better you could have succeeded, and take it as a lesson that moves you toward being that better person. And definitely don't fall for letting "be yourself" be an excuse to not be your better self.

4. Hold all knowledge as tentative. The difference between harmful dogmas and "absolute" knowledge is one that your subjective experience of that "knowledge" cannot differentiate. Before I realized this, I was extremely self-limiting and occasionally self-sabotaging.

This has been happening to me for the last few months.

What gets me is that my email address is not even in the recipients list most of the time. Much of it was sent to my email userpart @aol.com and somehow I'm receiving it in gmail. It seems like if you send a valid gmail userpart with an AOL domain to a gmail server it's just not bothering to spam check.

The filter rule that's doing the best job of weeding out this spam is that the email doesn't have my email address in any recipient field, but does have an AOL version of it. I have no idea why gmail would be accepting these messages though.

Not being falsifiable and not having evidence aren't the same thing. Conspiracy theories are usually centrally dependent upon something that is both outlandish and impossible to disprove, or some reasoning that is constructed so that it cannot be disproved, as any effort to disprove it is undertaken by "them" by definition and is suspect because they're all in on it the conspiracy.

There can be no evidence yet, it becomes a problem when unfalsifiability makes evidence irrelevant.

Bitlocker actually has multiple keys. There's one key to encrypt your data. There's a volume master key that encrypts the data encryption key. And then there are zero or more key protectors for the volume master key. One of those can be the TPM (or TPM with PIN), one can be a long password, one can be a recovery key (IIRC 48 decimal digits), and I believe there are other options as well. Each one is independently capable of decrypting the volume master key, which in turn decrypts the data encryption key, which in turn decrypts the data.

So ideally you'd just get your recovery key and store it someplace well protected like a safe or a password manager.

It's only useful if you know the voltage of the battery, so that you can calculate watt-hours, or if you at least know that two batteries you're comparing are the same voltage so you're comparing like to like. It's not useful if you're comparing batteries of different voltages unless you're adjusting for voltage in which case you want to use Wh anyway, which is why using Wh here is more useful.

GPL uses copyright and its viral aspects strongly to try to undermine copyright's goals. That's precisely why it is viral, because it is copyright, and doesn't make it any less viral. BSD-style licenses' terms minimize the viral impact of copyright on the free use of the covered work rather than trying to maximize that viral tendency toward achieving some opposing goal. The distinction still works fine. GPL is viral, as contrasted with BSD licenses, but not as contrasted with proprietary copyright, and for the same reasons.