gtsteve

A fingerprint sensor isn't possible, appreciated, but what about a U2F activation button? It could even just be a wireless pass-through for USB to allow your yubikey to work for example (I'm certain this can be done on Linux but unsure about other oses)

Perhaps your supposedly unique work is more repetitive than you thought: it just has a decision tree that's difficult to model with a regular algorithm, and annoyingly, it turns out you can just brute force that decision tree if you have enough electricity.

Unless your job is cutting-edge research where you are truly making new scientific discoveries and methods, you're just combining other peoples' ideas into a new unique package and selling it.

The truly valuable work is to notice that there is an underserved market and figure out how to meet their needs.

Which region? I've been using it consistently all day in Ireland and London. I just tried some USA endpoints and it seems to work fine also.

1k sounds like a discretionary amount that would quite neatly fit within a manager's budget for external consultants and so on, which is probably what they'll say you are when accounting for it. They're trying to fly under the radar, and have likely kept this knowledge to only a few people.

The organisation will never change their ways unless they get bad publicity or have to spend so much money that their c-suite gets involved.

I would be wary of trying to negotiate the payment upwards in case you are accused of extortion; just explain you'll disclose publicly in 30 days, which is more than enough time to fix what I assume is a web app backend bug. You don't want them dealing with this kind of issue as a feature to be implemented when there's space in one of the future sprints.

They may try at this point to negotiate the payment upwards, which is a matter for you and your conscience, but I would say that if you don't get something close to 100k, it's likely to be swept under the rug internally and they'll never learn from their mistakes.

I have hidden recovery information in a few places on the internet - someone stumbling across it would not know what they are looking at, or what it's for. For example, you can hide the TOTP secret for an authenticator app, but it's useless unless you know what account and service it's for, and the associated master password.

Email is not a good second authentication factor anyway. I have 6 u2f tokens on my high priority digital accounts, as well as printed recovery codes in several places. Only 1-2 tokens ever actually travel with me, the others are kept safely in different locations.

Given that most people are cracked wide open if their password manager is compromised, I do feel it's sensible for a password manager to insist on 2FA, but the email chicken and egg problem is a concern for those migrating, and hopefully they backed up their recovery codes.

You can use the powershell command Add-MPPreference -ExclusionPath[0] and ship a script with your app if you want. I do the same for Terraform providers - whenever a new version comes out, for a time the process can be randomly killed as I suppose a process that spawns a child process that starts talking to lots of endpoints looks somewhat suspicious.

[0] https://learn.microsoft.com/en-us/powershell/module/defender...

I would hope that high value target sites such as banks would implement CSPs to prevent that or make it more difficult though.

I'd make it a pluggable middleware with a document on how to implement your own and provide a reference configuration that uses something like Vouch [0] which will redirect the user to another identity provider.

You could also provide another implementation that implements Cloudflare's zero trust authentication [1].

[0] https://github.com/vouch/vouch-proxy

[1] https://developers.cloudflare.com/cloudflare-one/identity/au...

In other words, I don't think I'd want to actually take responsibility for authentication these days and use an authenticating proxy. The less security infrastructure you have, the less there is to go out of date.

You can always start with this approach and then implement your own built-in user directory later.

One of the techniques for a voice assistant to distinguish its own voice from background sound is called a Fourier transform, although I expect that the state of the art in this area also includes some other techniques and research.

If you've used one, you might know that you can easily talk to a smart speaker even when it is playing very loud music, it's the same idea.

This video explains more quite well: https://www.youtube.com/watch?v=spUNpyF58BY

Companies can quite happily hold two opposing viewpoints when it suits them. Apple's products usually have some kind of pleasing consistency but that doesn't mean their corporate dealings have to be.

In a similar vein, a startup will be very happy to talk about how valuable it is, except when it comes to talking to tax authorities, whereupon suddenly their shares are borderline worthless.

Do tell?

This is relevant to a discussion I am having at work right now. I am not a fan of using a templating language as such to generate string templates, especially for a whitespace sensitive language.

I would rather use Terraform's Kubernetes or Kubectl module for this. Are there any pros or cons I should consider?

I think one of the key things I like about it is that Terraform will show me what it plans to change whereas Helm doesn't (last time I checked)

> Okta isn’t a password manager. It’s an Identity Provider.

They're best known for being an identity provider but they do have a password manager product[0], which is what I think OP is referring to.

[0] https://www.oktapersonal.com/

> Obviously, this would be less convinient and wouldn't sync between devices. But would do the job.

Seems like you answered your own question. While it is less secure, my password safe is synced across all devices. I can also easily share passwords with my family members and I can assist them with lockout issues. I don't think there's a nice solution for this with Keepass.

Also, a typical implementation is that the decryption is performed on your device. I don't think you send your key material to the provider but I don't know about all of them.

It is certainly a "keys to the kingdom" issue as you noticed, and I don't put 2FA reset credentials in the same place for example.

I love the idea, unfortunately having read a few of these contracts (albeit not for a space so large), they do specify what the premises are to be used for and what they should not - I read one which specifically mentioned that paintballing or adjacent activities was not allowed, which makes me wonder if there was a story behind that. It would be very easy to terminate the lease for breach of contract sadly.

I now haven't used Mercurial in about 8-10 years or so. However, I recall enjoying the workflow a bit more, and I did like how commits were explicitly linked to branches as opposed to branches being effectively pointers to commits - it was nice to find out the original branch of any given commit.

However the killer feature of Git is the ecosystem. I was always having to do lots of custom work to get Mercurial to work with CI providers, whereas Git just worked and had first class support. It was clear after a while that our team would always be outsiders if we continued down that path, and there wasn't enough of a compelling reason to stay with Mercurial.

The two came out at roughly the same time and for the first few years it wasn't really obvious which was better.

Personally, I chose Mercurial to start with, because I liked the Windows tooling available and it felt a lot more like Subversion, which is what I used previously.

However, Git won the mindshare war in the end, so I moved over to that.

I hadn't heard of this website. Is there a page that describes what it does? When I navigate to poe.com, it just wants me to enter my email address and make an account, and I'd like to learn about what it can do first.

That you can imagine, clearly. There is definitely worse.

I too am not a lawyer. The current patent owners are Samsung and a Czech university [0], so I agree with this comment.

It is always possible that rent seekers will appear but remember, a good parasite never kills its host, and at present you are unlikely to be worth the energy to attach to (no offence intended).

[0] https://patents.google.com/patent/US10580193B2/en%29

How you solve this problem depends on why you want to solve it in the first place. Is this a business partner, a colleague or a friend?

What makes you certain that the technical decisions are bad? Any examples? There might also be economic, marketing or product fit reasons which are less obvious, depending on what information you have.

A search engine for physical shops, which indexes their items and inventory so you know where to go when you want a specific type of cheese for a recipe and you're in an unfamiliar small town.

Of course you can just ask locals but that's so analogue.

If this discovery is confirmed then someone will figure out how to do this safely, using robots or other kinds of machines to produce superconductor wires. The benefit derived would be simply too great to ignore it. Perhaps superconductors don't show up in your home but I can certainly imagine applications in optimising power grids.

I saw a cardboard lid in a coffee shop for the first time earlier today, it was good to see.

In the UK, we have a plastic bag tax, and I'm hopeful we can go further by adding a single use plastic tax to encourage more sustainable alternatives or for people to bring their own reusable coffee mugs.

For me personally, the plastic bag tax changed my behaviour, even though it's a small cost, it's still a cost so instead of just overspilling to plastic bags when my backpack is full, I just carry a couple of lightweight reusable canvas bags.

I have been doing this for several years now, and probably this has saved a hundred or more single use plastic bags just for me alone, and I hope that others can report a similar experience.

I used to find it very had to get into coding after a few hours of meetings and I find a 20-30 minute nap to reset works really well to fix that. Of course, it helps that I work from home and my schedule is reasonably flexible, I don't know how that would work in an office environment.

Lemmy has already massively improved since I first encountered it a few years ago. There are so many more users and so much more activity. I expect the usability issues will be worked on and resolved in time. Without a corporation behind it or some way to meaningfully monetise it, process will be slow of course, and I'm not sure it could ever become mainstream in the same way that Reddit has.

In terms of discovery, there is a centralised community browser of sorts... but you'll see it's got quite a way to go: https://browse.feddit.de

However, as someone willing to put the time in to learn something new I've found my efforts rewarded. It does take longer than 10 seconds to get used to Lemmy and the fediverse, but I'd say no longer than 15-20 minutes really. I enjoy being part of something new and I hope it lasts. Perhaps it won't hang on to many of the new users it has gained, but I expect this won't be the last time Reddit does something its users don't like and next time around more will stick, hopefully presenting a very good alternative.

I'm beginning to explore the fediverse more and have resolved to find an appropriate place to become part of it somehow. I don't think the fediverse as we know it today is the solution but instinctively I feel it's our best way right now to find our way there.

Some options spring to mind:

1. All rights reserved - the source is visible but not open.

2. AGPL, to ensure that if someone does take this forward, no part of it can be closed source without your agreement.

3. MIT, which is extremely permissive and effectively you don't care what someone does with it, commercial or not.

Depending on your comfort level I would start with the middle option, I don't think people tend to mind you re-licensing more liberally but if a community has formed and you decide to go commercial further down the road it can cause problems.