developer2

This has already been a thing for Macs as well for many, many years. If you boot into recovery mode, there is a menu option to add a Firmware Password. You cannot access recovery mode or enter the boot selection menu without providing that password, which means a thief cannot reinstall any operating system or boot from a Linux thumb drive.

When you add a Firmware Password to a Mac, you get a long recovery code as a fallback safety in case you lose/forget the password. Apple, if provided with proof of purchase for the serial number being inquired about, can create a bootable USB stick with a certificate generated using public/private key crypto for which Apple holds the private keys.

I suspect much of this newer functionality acts as a replacement for the Firmware Password, giving more options and making it a bit more well-known.

> one of the problems common in big test suites: poorly factored tests that end up being the sort of expressive duplication that is a giant drag on improving existing code.

I feel like you just described every developer/codebase where mock testing is stupidly enforced. Where every single unit test mocks every single indirect object. 98% of the testing code is just exhaustive setup and teardown of objects not being tested by each test, and then a bunch of conditional checks to ensure that every deeper/indirect method is being called exactly the right number of times with exactly the right arguments and returning exactly the right value. Almost all of the test code is just hacking mock objects. The actual purpose of each test is buried so deep that it's impossible to even understand the business logic being applied.

I hate evangelical "mock testers" with a passion.

Yes, you've got it right.

The encryption/decryption keys for your iMessages are stored with Apple, and are accessible to them. If you have iCloud Backup enabled, Apple–and thus law enforcement–can in fact decrypt them.

A while back, Apple was aiming to transition to store iMessage backups using a more secure method; ie. the same method that some other content such as Health data is stored, which uses encryption keys derived using local info such as your macOS or iOS password. The FBI requested Apple not to make this change, and Apple complied.

Apple runs a great PR game when they talk about privacy, but the reality is nowhere near the same. Some things are fully encrypted so that Apple cannot decrypt, while other things are not safe to store with them. iMessage falls into the latter bucket.

Source: https://support.apple.com/en-us/HT202303

For anyone looking to buy Steelcase brand new, it's worth knowing that the warranty for the fabric component depends on which series of fabric you choose from. The hardware components are all covered for 12 years, while the choice of fabric can land you the same 12 years… or as few as 5 years. The fabric options can be researched in advance[1]; find the matching swatch name/id, and check the bottom of the "Material Characteristics" tab for the warranty.

[1] https://finishlibrary.steelcase.com/

Aha, what I was looking for was the "Library" popup, which allows drag-and-drop of new components onto the canvas. Now I understand; this latest iteration of Xcode has the code <-> canvas being bidirectional, so using the library or canvas inspector just edits your code anyway! Interesting. I'll have to run through some docs and tutorials to see if I can finally pick up macOS/iOS app development.

I'd be willing to pay, but it's not clear what is included. For an initial look before paying, I downloaded a pirated copy. It only contains the components' html (and alpine, react, vue) snippets, with no extra documentation. If I were to pay for a license, would I get access to log into an account that has a full component browser with examples and extended documentation? If so, can all of that be downloaded as an offline copy, so that it will still be available to me if/when the Tailwind UI product/site is discontinued? Losing access to that important piece of the product would be unacceptable; I suppose I could curl a mirror of the authenticated portal if necessary.

The "simplest" button apparently contains the following ridiculous number of css classes, which is not the kind of css composition I'm a fan of. It may be the most flexible in terms of customization, but it's a nightmare to mentally parse and maintain. I would not want to manage a code base where nearly every html tag looks like this. :/

<button type="button" class="inline-flex items-center px-2.5 py-1.5 border border-transparent text-xs font-medium rounded shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"> Button text </button>

Hmm? From https://developer.apple.com/xcode/swiftui/ :

> Xcode includes intuitive design tools that make building interfaces with SwiftUI as easy as dragging and dropping. As you work in the design canvas, everything you edit is completely in sync with the code in the adjoining editor. Code is instantly visible as a preview as you type, and any change you make to that preview immediately appears in your code. Xcode recompiles your changes instantly and inserts them into a running version of your app — visible, and editable at all times.

I tried to get into it recently, and I couldn't even manage a "hello world" app. The built-in demo/skeleton app creates a text label in code, and that's it. I couldn't even figure out how to get what is now called the "design canvas" to appear; ie. to create a UI visually. I feel like the introduction to Xcode in 2021 is much worse than Visual Basic 6 was 20 years ago. :'(

I remember finding this setting before, for myself and at least half a dozen other people in my life. Not seeing the full URL is something that Mozilla should have fucking understood was something their users want. Firefox is supposed to be the "Good Browser™", which includes technical users configuring the browser for other people in their lives.

Every single goddamn time Firefox tries to bring themselves to being the bottom of the barrel, where "naive users need apply", they alienate their user base and all the other people associated to those users. I know that trying to grab market share seems like an "appease more people in the population", but Mozilla repeatedly seems to forget how much we are evangelical for those who don't even know that Firefox exists. The more they try to dumb down their browser, the more market share they lose. They still haven't learned this, and it completely boggles the mind.

Over and over and over and over and over and over and over and over and over and over again… Mozilla makes the wrong choice in trying to dumb down their browser. I could repeat "over and over" another few dozen times. They need a change in management at some level, because we're back to this dumb crap… again, "over and over again".

> Their UI was somewhat lackluster

I remember looking at ProntonMail 3 years ago, before I settled on Fastmail instead. To be clear, I have no intention of leaving Fastmail; they have the perfect feature set for me, and have been forthright and competent when it comes to publishing details regarding the problems that have cropped up with their service. I have nothing but respect for the Fastmail team. Russia is in the top 3 countries for which the blocking of Fastmail doesn't concern me; no service is immune to this kind of government interference.

That said… just to refresh my memory, and in case anything ever does happen to Fastmail in my country… isn't ProtonMail the one that had the WORST UI I've ever seen, where every click within the settings was a new maze embedded within another maze? I remember the UI for one of these popular and "secure" email hosts being so ultimately gross, as if it was designed and coded by a 10 year old who just discovered HTML with no knowledge of CSS, where it was just pages after pages of checkboxes and radio buttons with no documentation? Was that ProtonMail, or one of the other very few and far between options?

I remember only having looked at a couple of the modern options to cut my ties with Google, and Fastmail was so far above and beyond the other "viable options", such that it wasn't even really a choice. One of the options clearly looked like a lot of low-level work had gone into security, but that it was effectively unusable from the perspective of the users–including admins–who had to contend with its interface?

> there is a pointless weather widget added to my taskbar, and clicking on it opens the news?

I reached the question mark at the end of that sentence… and I felt that single question mark so deep within my soul. Clicking the weather widget opens the news……… "?".

Hahah, that's actually awesome. Of course someone out there put in the leg work to work around the licensing issue, and then shared it to the (minor?) masses.

Exactly this. Advanced tldr; I spent 2 years struggling with the inability to troubleshoot Apple's problems to help track down horrific bugs.

AirDrop from my iPhone XS to my Early 2019 iMac had always been hit-or-miss. It would usually take 3-5 times of tapping the iMac icon in the Share -> AirDrop menu before it would actually work and deliver the payload between devices. For the longest time I gave up on trying to use AirDrop… and this is only between my own devices sharing the same Apple account.

Another example was Universal Clipboard between the iMac and iPhone. It always worked in one direction (IIRC macOS -> iPhone), while the opposite direction (iPhone -> macOS) rarely worked. It made trying to copy/paste between devices such a chore that led to disappointment so often it wasn't worth trying anymore.

Finally, unlocking my iMac using my Apple Watch (Auto Unlock). It so frequently fell flat on its face that it simply became another frustrating pain point. It would unlock properly once or twice, then it would stop working. Unchecking/rechecking the option in macOS preferences did nothing, and in fact caused the System Preferences pane to glitch/hang/timeout.

I've always been on the same Wi-Fi network, with Bluetooth permanently enabled on both devices. Then… very recently–sometime in the last 1 or 2 months–I noticed that using AirDrop began to work the first time… every time; suddenly Auto Unlock stopped glitching and failing; and wouldn't you know it, Universal Clipboard also worked every time in either direction.

Note that all of the above features share something in common: they certainly all use the same underlying framework/library to communicate between Apple devices. AirDrop, Continuity, Handoff, Auto Unlock, Universal Clipboard. These all deal with passing payloads between devices; worse, they depend on Bluetooth, which has got to be the most unreliable wireless protocol ever invented. Bluetooth stacks have always been a goddamn nightmare; far too many different hardware, firmware, and operating system software/driver vendors implement their own versions of the specs, and they don't play well together.

I would put money down that Apple found and fixed a bug in either a) the framework/library that handles all of these features, or b) their Bluetooth firmware/software stack. Something was fixed quite recently that suddenly made all of these features go from being completely unreliable to working like Magic™. It took them a very long time to locate and fix this, likely because their users have absolutely no way to help troubleshoot these features. It either works, or it doesn't; and if it doesn't, you're out of luck.

I'm still sticking with the Apple ecosystem. There are some horrific bumps here and there along the way, but if I compare what I have now to what I'd have on a Windows 10 machine… not a chance in hell I'm going back. Hot damn, everything that's dropping this fall is going to be incredible. Well, at least once they iron out all the new bugs that will surely come with the amount of features they're introducing.

Extended Support ended January 14, 2020, however Microsoft is offering Extended Security Updates (ESU) until January, 2023. It's a paid program to extend security patches, having to be paid once a year for each of the 3 years; so only truly desperate companies are paying for this privilege.

[1] https://docs.microsoft.com/en-us/lifecycle/faq/extended-secu...

[2] https://techcommunity.microsoft.com/t5/windows-it-pro-blog/y...

The reason tables for layout were so bad was that the table as a whole couldn't be rendered (laid out) properly until every cell was fully rendered first, including images with unspecified width/height attributes as well as dynamic cell dimensions based on free-flowing text, etc. Floating div tags still cause redraws for containers with content requiring dimensions to be determined at runtime, but at least something would display. It was also easier to see which divs were causing redraws because their dimensions were not fixed, and thus developers could focus on those specific regions to try and add fixed dimensions.

I'm very thankful for Varenecline (aka Chantix/Champix); it's what got me to quit after many years of pack-a-day. I didn't even set a quit date when I started. That drug took away every tiny ounce of satisfaction I ever got from smoking. Every cigarette became a cigarette that did not give me what a cigarette is expected to provide. The best way I can describe what happened to me is that I felt like a non-smoker trying to smoke, and all I got was the scent and flavour of licking an ashtray with none of the brain-altering effects.

It's been over a year now, and I can't imagine going back. The only trigger I have is seeing someone else smoke, and even then it has never been more than a fleeting thought that dissipates within seconds. I know exactly what 2-3 puffs would do to me, and I have no interest in going back. I've never had the urge to buy a pack myself or to bum off someone. Smoking is now well into my past, and for that I am thankful.

I got the well-known "nightmares" from Verenecline, but I actually really enjoyed them. Those dreams were some of the most vivid and intense I've ever had the joy to experience. In fact, I still have the last 50 1mg pills leftover that I didn't need to use, and I've only kept them because I know I'll eventually use them just to revisit that kind of dream state. :)

Agreed, I don't understand why anyone reaches for uuid v4; it's the dumbest thing out there that sees regular use for no reason whatsoever. The number of developers who reach for uuid v4 is scary; I swear they don't understand what it contains, or care to think critically about their use case. The worst is reading about using uuid v4 for "offline client-side ID generation", such that any client can fixate object IDs that wind up in the server's database, and in fact are likely NOT unique if you have nefarious clients purposely generating duplicates client-side.

There is also no reason to give up 6 reserved bits of a uuid v4's 128 bits (it's only 122 random bits + 6 bits of unnecessary version info). If you want random IDs, make your own. Simply generate 16 bytes of raw data; or combine two random 64-bit integers; or combine a timestamp prefix with random bytes at the end. Your needs probably don't warrant exactly 128 (well, 122 bits) that uuid v4 gives anyway, so you can customize to a specific number of bits. You can also use base62 (0-9, A-Z, a-z) or base64 instead of hexadecimal (0-9, A-F) to reduce the number of displayed characters (eg. in URLs), while omitting the stupid hyphens of a uuid too.

tldr; uuid v4 shouldn't even exist, and certainly should not be used unless integrating with pre-existing systems.

And this right here is why PostgreSQL will never overtake MySQL and its forks. The entire industry is sick of these excuses regarding process-per-client instead of a proper multi-threaded model. There may have been a valid argument for this 15 years ago, but not anymore.

Your definition of "reasonable number of long-lived connections" is anything but reasonable. Then "connection pools address a lot of the other cases", when a connection pool/bouncer is unwanted, unwarranted, and just adds another point of failure that needs to be deployed and maintained.

I feel sorry for average non-technical people who get hoodwinked into VPNs. The majority of people have absolutely no need for a VPN for "privacy" reasons, particularly these days with wide adoption of TLS which prevents ISPs from reading and/or injecting content into streams.

Modern cases for a VPN:

1. The few countries/regions with severely corrupt governments/ISPs.

2. Accessing region-locked services; eg. another country's Netflix.

And if ad blockers didn't exist, they would still increase the number of ads anyway. If nobody could block ads, there would be no incentive for companies to be scared about having "too many ads", as there would be nowhere for users to turn to (ie. ad blockers).

The password/key never hits the Bitwarden servers. Bitwarden servers are just storage buckets for encrypted payloads. The server is never involved in the encryption or decryption process; this is the case for Vault, and now Send. All encryption and decryption is handled exclusively by clients.

Note the URLs used; all the important bits are contained in the fragment (after the "#"). HTTP clients do NOT send the fragment to the server; a "#" and everything after it is stripped before being sent to the server. Bitwarden's Send URLs contain an identifier as well as the decryption key in the fragment. When you load the page, JavaScript is able to read the fragment; an async request is made to fetch the encrypted payload using the first half of the fragment (ie. the payload's unique ID). Then the client–in this case JavaScript–decrypts the contents using the second part of the fragment as the key.

FYI, your email address is exposed on that page.

What an awful decision made by the developer. It is entirely unnecessary to display any account-related info to recipient(s). Some of us use a unique email address per company/site/account, and I find it unacceptable that my account's login would be exposed like this. It's the first piece of information required to begin brute-forcing or social engineering access to the account. I also use two-factor, but that's beside the point.

The developer hosts the game on a Polish domain (https://soldat.pl/), and even has a FAQ entry regarding the name: https://soldat.pl/en/page/faq

Q: What does "Soldat" mean!?

A: "Soldat" or "Soldaat" means "soldier" in the following languages: german, dutch, norwegian, swedish, danish, french, slovenian, afrikaans, russian, catalan and romanian.

Still no support for monthly, quarterly, or yearly aggregations. This is useless software at every company I've worked at; every business person wants statistics grouped into monthly, quarterly, and/or yearly buckets. "Last 30 days" is useless; I need each month in its own bucket (eg. January being 2021-01-01 00:00:00 to 2020-01-31 23:59:59).

Yep, that's an indication of Elasticsearch being used (and not transforming documents to a standard representation that strips such fields).

Just watched it over the past week. I enjoyed it immensely. I don't care whether its depiction of chess is realistic. The lead actress is superb in her role. Its depiction of addiction and depression was spot-on with my experience; many of the scenes gave me chills, particularly when the adoptive mother is involved (whether directly or indirectly).

Highly recommended: "The Queen's Gambit", 7-episode miniseries on Netflix.

> I think there's some rose-colored glasses effect going on here

That may be anecdotal based on brand and model. I can agree with you in this case because I've got the Brother DCP-L2540DW. I got it on sale for $99 CAD (~$75 USD) when it was still the newest model available. I'm using the stock cartridge still, though I have a refill purchased and ready to go in case it's not possible to buy one when the original powder runs out.

This line of Brother printers is indeed good. It's impossible to say whether this applies generally to any laser printer, or to any Brother laser printer, or if we were simply lucky to have picked up these particular models.

I don't understand how the average person cannot comprehend this. The point isn't to "hike far, fast"; it's "walk around, hang out in nature, maybe wind up somewhere new." Maybe he wanted to head out, push as far as he was able and willing, and then die. Maybe he was sick and tired of living and working in our shitty society. What's so hard to understand about that? Particularly with the cash he had on hand, which is exactly what I would do: clear out bank accounts and/or max out credit cards with cash advances, and then disappear forever with no expectation of dealing with a financial institution ever again.

The assumption that he must have died purely by accident is absurd; or, if not, that he must have been mentally ill. I could absolutely see myself doing this in another 5-15 years. There's so very little worth living for, but I learned 10 years ago I'm not willing to off myself in the ways people normally do. Heading out into nature and lasting as long as I can on my own seems like the workaround to "being ready to die", but "not willing to hang, shoot, or poison myself".

No, I don't need help. Tried the suicide route 10 years ago (very seriously, not as a call for help), and discovered that I'm not quite that fed up with life yet; and when I am, that's not how I want to go. This story is exactly the kind of method I'd use if the desire to fade from the world resurfaces.

This is frighteningly standard across most companies with no serious planning phase for new features, and no code review process. Fact is, some developer was told to create a REST API for password resets, and to return the secret token so that the (internal to the company!) client can send the email containing that token. This developer did their job correctly.

At some point, a different developer was told to consume this endpoint, send the related email, and tell the end user (browser client) that the email was sent. This second developer is not part of the "senior services team" who designed the above API, which is perfectly valid. Instead, this is a junior developer taking on their first task at the company. "Take this password reset API endpoint, and integrate it". In addition to queuing the password reset email with the token embedded within it, they also accidentally proxy the password reset service's payload to the browser. No intermediate or senior develop reviewed this new employee's PR; if they did bother to look at it, they only checked for coding standard violations (eg. indentation), without taking the effort to understand the logic of the code.

This is actually extremely common, unfortunately. The server-side layer that directly interacts with clients (ie. browsers) is generally delegated to the most junior developers, because it's menial and uninteresting work to connect the backend services to the browser. The current senior developers spent years working on that kind of garbage already, and they'd rather work on the "more interesting/advanced" backend work. Thus, the junior developers whose skills aren't yet honed are stuck–typically unsupervised–working on the front-facing components.

Also, this routinely happens at companies which rush every feature out the door with modern "agile" practices. The sprint is almost over! Quick, deliver all features by tomorrow to keep up our velocity and avoid a sprint review with negative feedback! Just merge it and push to prod without QA on a Friday at 4pm!

If only the above was a comedy routine, rather than what it truly is: the genuine reality at a large number of companies.