gepeto42

Cancelling my auto-renew. We will see how it goes, but paying 150USD a year for a blog that USED to be independent when I decided to pay for it feels pretty bad.

Absolutely does. But it would definitely keep you away from switching between 13 Slack groups!

I feel like my phone is so sluggish when in low power mode (even a 17 Pro), that it could work for this.

After using the cyber defense matrix quite a bit, it felt obvious AI required it to evolve.

Will definitely try this one out for security architecture projects etc.

The last year has shown that this vector is getting weaponized for real so it's great to see more tools to help defenders!

Is this something only companies with public repos should be worried about?

Been running it for about two months.

A few thoughts:

1 - I replaced 2x4k 27inch monitors, and so far so good, only annoyance is sometimes I want to share an entire screen as a reflex, I have to remember to have a more window focused workflow.

2 - The power brick is GIGANTIC, but it charges one of my laptops at 96w

3 - It is a bit blurry due to the antiglare coating. Might be annoying to some.

4 - The built-in USB hub is good enough for my Razer Kiyo Pro Ultra, and it gets switched to my active computer, unless I am using HDMI (no USB link available separately from the Thunderbolt or USB-C main ports)

In general, I wanted an Apple XDR display, but with multiple inputs. The results are not as good from an image point of view, but better from a productivity point of view.

They’d likely block you if they detected something like RDP open, cause that would likely indicate you’re hiding your real IP address.

Thanks for recognizing it, it was absolutely by design!

I don't have my home email on work devices. I also don't have my email on my gaming PC (I agree this must be rarer). I don't have all of my work emails on my personal devices either. So now when I log in I need to DM myself links over Slack, or forward emails around...

I have to admit I bought it mostly to annoy a few very specific friends, but then I kept using it. I would not recommend trying to host anything serious on such a TLD.

If you check the early comments on the thread I posted the full content for someone else who could not reach .zip domains.

You're right, I forgot to even cover that part because I was focused on how annoying they are to me as a user, not necessarily as a service provider. I also forgot to mention how they train people to click on links, how my inbox now consists of dozens of emails per day telling me to either click to login, or warning me that I logged in.

I have my own domains for email so I haven't had the issue of someone else entering my email but I keep hearing from friends getting that.

Yeah that would not surprise me, in general. I don't think that would be 404's goal, since they provide full-text RSS feeds I could share with a friend easily, but I could see that happening with other services.

As someone in the security industry, I find it amazing how much we've told people (in awareness training) to "not click things on the thing-clicking machine™" while simultaneously having processes like password resets that require doing it.

™Kelly Shortridge 2021 (https://x.com/swagitda_/status/1503751776134180873)

Even with passkeys or TOTP 2FA, we've decided email is the root, for better or for worse (for people with gmail, it's likely better than SMS would be on a crappy carrier, but it depends on so many factors, including how many hundred apps have Gmail read access via OAuth...)

To be fair to 404, they're trying to limit the amount of data they hold which IS good, but in the end they need to have the email address of subscribers.

What I'd recommend is if you're worried about this (or worried about it in certain instances), disable biometrics to unlock the device itself. Then, passkeys on it don't really matter anymore.

I meant Ricky’s post is great and if I had known about it first I might not have written mine! Added a link to it at the bottom of mine.

Thanks for that link, I had not seen it and if I had known Ricky Mondello had written that, I probably wouldn't have bothered.

I'm still used to Apple people being almost completely invisible publicly.

Some of them make it way easier for threat actors to obtain large amounts of domains for cheap or free, without fear they'll disappear right away.

Paul Vixie had a great talk and research about this ~2018: https://www.youtube.com/watch?v=nkoNjntc5Lw

Yeah the Stratechery implementation for podcasts is great. The more annoying thing is each of them has its own domain and requires logging in, if you don't know you can dig into Stratechery.com. I would prefer if I could login to it with a passkey or username+pwd, but it's a much better system overall than just dropping an email link.

You're welcome. Been thinking about it for a few days, and I had to do it. I don't disagree there's some benefits but being told "IT'S BETTER!" annoyed me quite a bit.

Because I'm an idiot who likes hosting stuff on bad gTLDs, here's the markdown content of the actual post for you and everyone behind some corporate firewall that blocks dot zip:

The term "Magic Links" once meant a [futuristic PDA](https://en.wikipedia.org/wiki/Magic_Link). Nowdays, companies like [Auth0](https://auth0.com/docs/authenticate/passwordless/authenticat...) use it to refer to the slightly-magical feat of including a login link in an email.

Last week, the great website you should subscribe to if you haven't already (it's great, when you're not logged out), [404 Media](https://www.404media.co/), posted ["We Don't Want Your Password"](https://www.404media.co/we-dont-want-your-password-3/) in defense of so-called magic links.

Of course, as stated in the article, such email links are harder to phish than passwords, can't lead to a breach of passwords, and protect the site itself against users who might reuse passwords previously compromised.

The article even covers some of my annoyances with this system, but throws out this sentence:

> [We find this to be a much easier login process and wish it was more common across the web where appropriate.](https://www.404media.co/we-dont-want-your-password-3/)

Easier than what? Easier than a long password, without a password manager? Easier than a passkey? Easier than an OTP sent to the same email address?

This sentence reads to me as one written by someone mostly working and _living_ from a single laptop and mobile device. The second part of the sentence, calling for more sites to do this is why I am writing this.

For any scenario with a minimal amount of complexity, like users with multiple computers, and you're looking at a scenario where the site's unwillingness to deal with other login methods shoves friction on the end-user.

### What makes them tragic:

1. Multiple devices. Who doesn't use at least a few computers weekly? I don't have my email on my gaming PC, nor do I have it on my work laptops. 1. Slower. From 2 seconds slower to minutes slower, depending on SMTP delays as well as how awkward it is to get the link to the right browser. 1. Anti-mobile. As mentioned by 404 in their own article, this breaks the ability to use in-app browsers, which is quite annoying especially for RSS reader type apps. It makes interacting with any local link in the RSS feed extremely annoying. 1. Indirect security downsides. Pushing people to access personal email on work devices (or vice-versa) isn't exactly a win for security.

Another annoying _passwordless_ system is to email or SMS an OTP the end user can type in.

While this sucks, it at least allows you to easily log in in situations where you don't have a clear and easy copy/paste path from the email client to the browser you want to log in to.

[Stratechery](https://stratechery.com/), powered by [Passport](https://passport.online), uses this type of scheme (click link OR type in OTP), which is still shifting annoyances onto end-users to free developers from implementing passkeys, but at least has a bit more of an appreciation for end-users.

If you insist on using magic/tragic links by default, at least consider offering a robust alternative, such as [passkeys](https://fidoalliance.org/passkeys/), especially if your audience is technical and privacy-focused.