tatersolid

Voting officials should be selected by sortition at all levels, similarly to jury pools. Allowing self-selection can allow for collusion or a biased pool of election workers and judges.

I’ve taken to using “US/Eastern” or “US/Central” for clarity. The normal folk understand this format perfectly and they are part of the IANA standard time zone list (aliases for America/New_York or America/Chicago). Also avoids confusion when working with folks in Europe for whom EST means UTC+N depending on the country and time of year.

> We'll probably never convince end-users to "vote with their feet" and use Privacy-focused products.

I’m not so sure. The iPhone is the most popular in the USA despite the cost premium.

Still a fan of Hover. No crap, no scams, just works.

I know it has no security impact in this case, but isn’t it odd a bunch of cryptographers would choose a weak PRNG seeded by the date for a task like this?

Even state lotteries back then used physical ping pong balls and a nothing-up-my-sleeve show after the evening news.

The prolonged conspiracy theories until this discovery make some sense… not having a ceremony around anything supposedly “random” is unexpected, even back in the 1990s.

Based on the features and design, did Anthropic just re-invent and vibe-code Subversion?

> log parsing

There’s your problem right there. You’re lighting money on fire using an LLM to do a token-intensive deterministic task.

To minimize annoyance I’ve set my password manager to generate 16 character random passwords by default. This seems to be the sweet spot for the USA; I don’t recall recently encountering a site with a min >16 or a max <16. Assuming 85 chars that’s ~102 bits of entropy so plenty strong and compatible with almost every site (excepting the rare idiots that ban repeating characters or some subset of symbols).

General Magic failed with all the talent and all the resources. Cautionary Tales podcast featured General Magic in a recent episode; the basic argument was no constraints led to no focus.

My kids stopped saying “six seven” about a year ago. I still have no clue what that was about.

> sites are extremely pushy about replacing your perfectly good password with a passkey

Your password was never “perfectly good” because it is easily phished. Even with TOTP or a push notification app as MFA.

Phishing is an huge risk even for “expert” technical users, and such phishing is the cause of a huge number of breaches and supply-chain attacks.

> most systems have the same username and passwords (customers never change the defaults)

That is horrifying and 100% on your dev team. You should not ship default credentials, instead require unique creds to be set at install. Ship an update which required default creds to be changed.

Who do you think you are, Cisco?

Entra External ID does not allow export of password hashes.

It actually doesn’t allow a whole shitload of stuff that should be there by now.

For example, it supports passkeys, but has no UI for adding or managing passkeys. You have to build that yourself. In a separate app, on a separate domain.

USB Ethernet dongles generally suck. Even “name brand” dongles are cheap crap from contract manufacturers.

He’s a Florida Man. Do not underestimate his capacity to defile himself.

https://en.wikipedia.org/wiki/Florida_Man

Current nuclear-powered ships are run by the world’s premier naval powers and protected by their own stealth or a huge array of armed escort ships.

Have these guys factored in the cost of a task force of protective missile frigates, subs, and destroyers at each site?

It’s a rehash of a conflict from abut 3000 BCE onwards. Who really is the “historical people” of the land that is now Palestine/Israel has been the subject of bloody conflict for 5000 years.

So this is strange, it popped up on Cloudflare’s RSS feed so I thought it was new. I’m guessing they edited the article but haven’t been able find a a diff against the original 2022 version.

The Indiana variant of this phrase was “tighter than two coats of paint” which meant a person who was tight with money (cheap).

For tracking uniques, why can’t we just set a “first_visit=false” cookie if not present on first request? The number of new unique users is then the number of requests that came in without that cookie in whatever time window. Expiration timeline left as an exercise for the reader (month, week, whatever).

This zero-entropy cookie cannot be linked to a specific person and would not require consent under any privacy law I think.