mixdup

The point is to prove you control a domain. If you are answering traffic to requests from clients at that domain, you control it. Whether you're supposed to have control over it is outside the scope of this validation

The linked article isn't entirely correct. Yes, in smaller counties and towns the 911 call center may be led by the police department but in any city of any meaningful size, the E911 call center is a stand alone department. Sometimes within a wider public safety department but that department usually includes fire in addition to police, and 911 is usually a peer to the police not subordinate

The focus should be on who is dispatched on the types of calls, not the organizational structure, because in most places it's already what you'd expect and not part of the police

There needs to be a force that can be dispatched to these types of calls, just like they know to send the Fire Department if it requires some kind of engineering/rescue but isn't a fire and isn't a medical call

>It even grabs your Sticky Notes for WHAT????

Because people very VERY often will stash passwords/account numbers/other commonly needed secrets in Stickies

ASML's order book is way way way at the tail end of where the signal of the bubble's bursting will be felt

Users sign up for Claude, Claude buys more compute, AWS/Azure runs out of capacity, Microsoft buys 10,000 acres in Virginia, Microsoft places order for a million GPUs from NVidia, Nvidia places order for a hundred million GPUs from TSMC, TSMC buys 1,000 acres in Arizona, TSMC places an order for a bunch of new ASML machines

Yes, the end of that chain is the one I'm goin to watch to know when the bubble has burst, not the beginning of it

Having two phones is more common than you think, and has a very plausible explanation even if it's not true for the particular individual: One is my work phone, issued by my company, other one is mine

That happens all the time

I'm sure they exist but I have yet to come across a service that both removes the ability to also use a password when you register a passkey and also has no other recovery methods if your passkey (and/or password) become unknown or unavailable to you

In theory if I locked down my Apple account with the advanced protection features that are optional, I could lock myself out, but it would be on me to save recovery codes/secondary passkeys/etc during enrollment in those optional configurations

Otherwise, I'd walk into the Apple Store and they'd be able to get me back in my account if I didn't have some alternate method to get in

I don't need to, I'm not bouncing around password vaults with the frequency of a cheap HAM radio. I've skimmed over announcements of the feature becoming available in a product or two

I cannot possibly game out all future adverse design choices that a vendor may make. Today, October 14th 2026, Passkeys offer more upsides to me than they do downsides, so I use them

If a particular app vendor or website changes how they accept or use Passkeys, then I won't use them for that app or site. If my computing platform vendor(s) make it harder or worse to use Passkeys then I'll bail out

There's a lot of what-ifs in every decision, and I cannot possibly nor would I want to, figure out 82 steps ahead in 4-D chess how company X may try to screw me over

As long as they didn't turn on the advanced protection features on their account they just go to the Apple Store who can help them get back in

What's the difference between using a really good password vs. public key authentication in SSH?

Okay? At some point mail applications didn't support IMAP, because it was new. Was IMAP bad because it forced POP3 clients to build new support that they didn't previously do in order to support the improved functionality?

OAuth wasn't about lock-in (since any client can support it), it was about getting off shitty legacy auth

Is that the same thing we're talking about here? That sounds like a CAPTCHA, not Passkeys. I mean iOS isn't doing attestation in Passkeys, I'm sure there's some thing on the phone that it's doing that is a version of attestation

Well, at that point I'll figure out what to do. I can't live my life constantly working around bad design that doesn't actually exist yet

Well, they're synchronized to my Apple account so that's not an issue. They're available on all of my Apple devices, or even ones I don't have right now that I log into in the future

Plus, none of the sites that I use passkeys for would I be locked out. They all have account recovery procedures just like if I forgot my password. And, finally, for the important ones like my Google account (where my email lives) I have other non-Apple devices like a Yubikey setup as additional Passkey/FIDO authenticators

It's fairly easy to export/transfer passkeys (I think, I've never actually done it)

Also, many if not all of the sites I've got passkeys setup with support multiple keys, which I sometimes take advantage of. For example I've got a passkey into my Google account in my Apple account ecosystem but I also have a physical Yubikey setup as a Passkey device, in case I were to get locked out of my Apple account

Just don't setup biometric authentication on your device, then? You don't have to use FaceID to unlock passkeys in iOS for example

Google would not do something that would lock out half of the mobile device market. iOS doesn't do attestation.

Also, is there a reason Thunderbird or other clients couldn't use OAuth? I'm fairly certain I can login to GMail on Mail.app in macOS and other clients, so they're not using that to lock people into the official app or their browser

100% correct takedown of the "Trap" article

Do passkeys have issues? Sure. Most of them are UX and are being worked on. As a user, I 1000% immediately register a passkey when a site or app offers it as at least on iOS and macOS, it is a superior user experience IMO and more secure. I never worry if I'm getting prompted for a Passkey, am I on the right site?

Also the remote connect functionality of modern browsers and mobile operating systems makes it trival if I need or want to sign into a personal account on my work PC where my personal passwords are not sync'd. Need to get into my personal GMail in an incognito window at work? No problem at all.

Anti-Passkey folks are just people who want to be against something to be against it

The ease of returns was a huge factor in the early success of Walmart, as well. I worked there in high school and college (99-02 timeframe) and they harped on how much the customer was right for returns, unless it was just blatant fraud. if there was a chance the customer was not trying anything you just give them their money back

>There's a lot of assuming bad faith on the part of the FIDO alliance

Yeah, it's just a bunch of "big company bad!"

Yes, Google and Twitter and Yahoo are just trying to get your data and sell ads, but I fail to see how Passkeys furthers that specific goal. Even if these companies have bad motivations in certain parts of their business, they all have an incentive to make accounts more secure (to reduce fraud) and improve the user experience (to increase engagement/happiness)

you're not entitled to an open platform. if the market determines one is not worthy, then it's not worthy. don't like it? start contributing to open source projects

that said, we've never been closer to Linux on the Desktop (TM) than we are right now, even if it's through dumb stuff like Omarchy. There's no risk today that you won't be able to, in 10 years, buy an x86 or ARM laptop and put some flavor of Linux on it for personal use

That they've put it behind Cloudflare doesn't mean it's "served by Cloudflare"

Maybe Cloudflare gives them a good rate, or is donating service, but it's also possible or even likely that IANA is just using Cloudflare as a vendor, and therefore is paying for all the traffic, which is why they don't want people relying on it or hammering it all the time

The only risk is that Apple hasn't announced it as being reliable or promised to keep it up or the format the same in any way. They could 100% pull it out from under everyone, with modifications in their OSes prepared for the change

a) I don't respect second amendment nutjobs. We don't have unlimited unfettered free speech rights, why are firearms special in that regard that they can't be regulated like my mouth can be?

b) there are plenty of options for completely open computing platforms. Apple has every right to build the platform they want to build, and you as a consumer have every right to go buy a Framework laptop and install Debian on it instead if you don't like it

I don't think "let's just stick with how things work in the actual firearms industry" is what I was going for or a sane position to take on just about anything

Because people will shoot themselves in the foot if you give them a shotgun. A big part of why the Mac as a platform blossomed in the late 2000s forward was because it was much less likely you'd get hacked by clicking the wrong link or just opening an email than it was on a Windows machine (among other reasons)

And, all of that said, Apple hasn't said anything about not letting people have full access to their disks. Just that you're going to have to be very intentional, click through a very scary warning, to do so. Happy to do that to prevent my mom or dad from accidentally opening up their machine to every hacker in Belarus or worse yet Facebook

I would argue that someone who would open a remote access port to the internet with no filtering is exactly the kind of person that Apple needs to protect from themselves

Yeah, it was neat that Claude found this, but Thompson showed an almost criminal lack of security awareness by having VNC/ARD open to the internet

>but how would it reduce the number of employees needed?

A standardized reactor design that doesn't need a bespoke training control room at every single site means fewer training staff. It means the same maintenance workers and compliance workers and everyone else can be utilized more because they can cover more facilities instead of just the single site they are certified on and work at

imagine how that number can be decreased as the plants are smaller, standardized, and more numerous. you can likely get a lot more efficiency out of the workforce when an engineer or operator can work across a dozen of these in a 200 mile radius instead of just one in the whole country. plus you need fewer training staff etc

Natural gas plants all have security, insurance, maintenance, and staffing. Of course there are different levels of those but those costs are not unique to nuclear plants