growse

Alternatively, IPv4 simply does not scale effectively on the LAN, whereas IPv6 allows much simpler addressing and routing topologies. Simple = good.

My blog's hosted on either 3106689564 or 42540619367231808600192856535952785520 depending on your addressing scheme.

See, no colons in sight!

You're welcome to not use hex. For either addressing scheme.

You just have one big one on the root.

(Half joking).

Thank you for articulating.

> That passkeys come with some limitations, like oh by the way, now you're stuck paying Apple/Google/1password a subscription fee for the rest of your life, is merely a happy side effect for the corporation.

I see this, but I disagree with the conclusion for two reasons.

1) there's no evidence of this happening in the consumer passkey space despite enormous opportunity.

2) we already have instances of lock-in to services by service providers. Whether it's banks demanding you use their little weird dongle to login, or apple demanding you use an iDevice to use airtags or parental controls. This is, I agree, a problem. But the market seems to be working it out quite well

I disagree. TFA is extremely muddled in it's thinking, and the appeal to conspiracy is rather distracting from any good points that might exist.

Hence my question about "why though?". The only answer I can see is "user control", but I have no idea what that is. It sounds like a means, but to what end?

I don't understand what "Complete user control" means, or how it relates to passkeys?

> Where is it required?

Lots of places where you might have specific requirements about your authenticating users. E.g. to achieve FIPS compliance, or if your user population is low-single-digits because it's critical national infrastructure.

> I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.

I most definitely do not want operators of CNI to be "inventing their own" that can trivially allow compromise or weakness. "User freedom" is not the prevailing value in a lot of authentication contexts.

https://cphpost.dk/2026-10-10/news/round-up/123456-password-...

Why though? What's the objective, and why are passkeys the easiest way to achieve that objective?

BigTech doesn't need attestations in the passkey spec to limit freedom.

Attestations were added so that highly specific domains where attestation is required (by law, a regulator etc.) can still use the same passkey spec as everyone else without having to invent their own thing.

If there was benefit to BigTech of locking in Auth to a specific device, they'd have done it long ago - it's not difficult.

Apple and Google don't need the passkey spec to mandate that you only use their services from non rooted Google/ Apple devices. They could do it before passkeys existed, and they can do that right now if they wanted to.

What's any of that got to do with passkeys and attestation?

Flags Wikipedia articles where the subject's parents also have Wikipedia pages. Draw your own conclusions.

A clock ticking every second is generating an event every second.

If you sample the CPU usage at 1Hz, the metric is attached to the tick event.

What I find confusing about this is that otel is two things.

1. A spec 2. A ref implementation

Similar to other projects (e.g. python), if there's complaints about (2), that should trigger an ecosystem of alternative implementations that are guaranteed to be compatible because of (1).

I suspect there's actually quite a few private, separate otel implementations. Maybe these just aren't being contributed as oss?

> Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP.

I feel like we need the angry goose meme here.

"But why are those providers returning incorrect data?"

> No one.

I thought everyone was "trying so hard to re-invent PGP".

> we do need a single key that can be used for all those things

We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?

Who's reinventing a tool that can do all that?

> Everyone is trying so hard to re-invent PGP

Which bit of PGP?

I don't know enough about either the technical nuance or the political drama, but some observers have noted that GnuPG's implementation is (deliberately?) incompatible with the IETF's standards. It's not clear why.

https://floss.social/@hko/116459621169318785

Maybe your company's ISP is CGNat'ting you?

A non-trivial minority of the time, they don't support IPv4 either!

I do similar, but frame it in terms of dependencies.

The database can live without the web server, but the web server doesn't work without the database.

Therefore webserver ---> database.

Key thing in that these deployment / context / container diagrams don't have a temporal axis. If you want to represent a flow, then you want a diagram where time has directionality, like a sequence diagram.

If I accidentally yank the power cable out of my load balancer, I can plug it back in and I'm back up and running.

If I cock up my DNSSEC config, nobody can resolve any records under my org's domain (goodbye internal email!) and you've got to twiddle your thumbs for a period of time waiting for various timeouts to pass (go ask Slack how it went for them).

These things are not the same.

> As if DNS isn't a major contributing to A LOT of downtime. That doesn't mean it's not worth doing not investing in making deployment more seamless and less error prone.

Ah yes. Let's take something that's prone to causing service issues and strap more footguns to it.

It's not worth it, because the cost is extremely quantifiable and visible, whereas the benefits struggle to be coherent.

That entire post is that you should enable DNSSEC because it's "more secure", and there are no reasons not to.

"More secure" begs the question "against what?", which the blog post doesn't seem to want to go into. Maybe it's secure from hidden tigers.

My favourite DNSSEC "lolwut" is about how people argue that it's something "NIST recommends", whilst at the same time the most recent major DNSSEC outage was......... time.nist.gov! (https://ianix.com/pub/dnssec-outages.html)

If you're in (for example) a CI context and do a git checkout @tag, there's no guarantee that you'll get the same content as the last time you fetched that tag.

Tags are not immutable.

> Why is entitlement to others labor the moral position, instead of the immoral position?

You seem to be mistaking me for someone arguing that anyone is entitled to others' labour?