PennRobotics

If you asked me to pick out bright bold blue (#0000FF) and told me the format was "Lightness Chroma Hue" with valid ranges, I would guess "0.5 1.0 240". Not only is this "not visible on any monitor" by a very large margin but the oklch.com calculator states the spec fallback color is Dell logo blue and not bright at all while browsers will render "vibrant purple".

There's not "120 degrees of red, 120 degrees of green, 120 degrees of blue", so blue is not 240. Actual bright blue is hue 264. The "0-255 RGB" bright blue is 0.452 lightness, and max chroma on a really good monitor is something like 0.33. The lightness mostly makes sense, right? 0.5 is halfway between totally dark and completely washed out.

"Ok, so chroma tops at at 0.33" not so fast. You can crank up the chroma to 0.40 and still get either magenta (where lightness is around 0.74) or green (lightness around 0.78). So now you need to know a valid, nonlinear lightness range for each band of colors, because midpoint blue is different than midpoint red which is different from midpoint green.

From greyscale luminosity calculations and knowing about subpixels and bayer filters, I would've been able to guess that green is the color with the highest chroma, but then there's bright magenta, neck-and-neck. Oh. Until I move the lightness slider down on the web color picker, and then everything (especially peaks) in the chroma channel shifts around dramatically... So much for intuition.

While OKLCH makes it really convenient to select colors with properties you like along a gradient, the nonlinearity means either memorizing a bunch of base colors, using a color picker, or converting from a system that is "actually" intuitive. I can't really look at a trio of OKLCH numbers and predict the output color like I'd be able to with RGB, although this is mindful that RGB is also not linear (for the exact opposite reason as OKLCH) and I can only do that from decades of experience.

I'll concede that magenta and bright green and bold blue don't really have a place on the world wide web other than in a company logo, so these are outliers. Still, the OKLCH format is not what I'd call intuitive to a total beginner.

(Also, I'd very much not like to implement OKLCH calculations on a microcontroller until lighting companies start selling OKLCH LEDs.)

Why wouldn't we be like pets to superhumans?

They'd care for us but wouldn't give us total freedom or value our input. My dog has no say in the computer I buy and goes on walks and visits other dogs when I decide, but I still think it's cool to watch her ambush mice or catch a frisbee.

A superintelligent being would probably find intrigue in the uniquely human things we do and will keep us socialized and meet our basic needs because it's how to keep us pleasant companions.

My Thinkpad from the same 2022 timeframe (a Z13 Gen 1) was very awful all around, particularly w.r.t. sleep. Lenovo serviced it multiple times, never fixing it and refusing to complete a return under warranty. (Happy ending: Laptop got stolen. Insurance paid.)

I have the hope that Lenovo acquiring Phoenix will fix some of the awfulness.

There is a guide on Reddit, "How to enter advanced BIOS options on Gen 1 T15(g/p), P15(v), P17" which also applies to each generation of P16. It's possible a setting in there will finally cure your laptop's insomnia?

Corners and borders have been a pain since the beginning of GeoCities. I do wish fancy corners would go away---to the point that I actively make this happen with a global Stylus rule setting border-radius to 0.

Look: Three of these 10 "improvements" deal with corner shaping, and two more will inevitably need extending, as I imagine frontend devs get around to, "GPT make reading-flow responsively round only the outside corners," and, "Claude how to squircle the individual grid cell borders when using rule gap decorations."

I understand CSS wants to do all of the things and do them well, but then the eye candy gets overused on every webpage and web framework template to the point that practically no site feels different; it's all "logo, four links, giant-ass 'call to action' rounded button in the bold colored top nav, rounded corner cards in a grid layout 3 to 4 cells wide (or in a slider), gratuitous whitespace, rounded corner everything actually, maybe a gradient text or background or both, hamburger menu on mobile, all styles inlined in the HTML classes".

Going down the list of Fortune companies, three of the top 50 don't "round corner" everything: Berkshire, Exxon, Morgan Stanley. A few more would count if you permit rounded buttons only. Marathon is a weird outlier; they have hexagonally rounded elements buttons. (Also, some of these sites must be hosted on a Zune. It takes 50 full seconds to load Cencora's main page.)

I can't say that I do web dev any better, although I am disappointed by the looks of the modern internet, and I don't think more artistic flair will make it better, just as I don't think houses and cars and suits benefit from strange shapes and colors.

although maybe more choice will free us from the confines of everything looking like Tailwind? (Despite my complaints, I am grateful for progress and also am absolutely not looking forward to people misusing functions and dropping 18 errors and 11 warnings into console.log AHEM LENOVO because they can't be troubled to write good code/markup.)

The normal person will click the "Use password instead of passkey" link conveniently placed by the impersonator, who will then have an email address and set of user-provided password guesses that they can try on other domains.

Less than a week after this was posted, "Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites." (Source bleepingcomputer.com)

I get the sense this weakens the common argument that your 'passkey is bound to the domain it was created for'.

Sure, passkeys are still (on average) more secure (we assume) than strong passwords and TOTP.

I'll still take "email me when a login attempt is made (pass or fail)" and "I generate my own keys for something like Tailscale" and "2FA (especially single-use recovery codes, with email confirmation upon use) ONLY needed for account changes and banking". It's the right mix of convenience, recoverability, verifiability, and security.

Agreed! I don't want an aggressively locked-down system. I don't want every application sandboxed as the only well-supported offering. I don't want to learn a new paradigm for letting a browser configure an HID device. I don't want to buy a Mac just to have working DAW plugins. I want to have wmctrl scripts (or, on Windows, AHK) at work so that I don't need to manually drag every window for a specific workflow across multiple computers into it's proper position and size.

The Android security model, FWIW, is also annoying as hell to me. You used to be able to translate inline without an always-onscreen "bubble". Most Android implementations will auto-revoke permissions on unused apps. Older apps (like the Neumann microphone app) were feature complete and have no obvious mechanism for remote exploits (it's a special purpose calculator) but will no longer run on modern Android versions "for security reasons". (You can still install the hard way via adb incantations or retargeting the APK to a supported SDK version.) If I use Dmytro Ponomarenko's audio recorder, I can't access recordings using Files, the "easy way" is to click Share and then email files to myself or install a third-party file manager and give it broader access permissions. It's hit-or-miss if password managers detect the entry field in a browser. It took way longer than necessary to figure out how to get an app to read/write an HID device using the Android Developer documentation, and even after specifically targetting one VID/PID in the source code, you still need to verify you want to access your connected device every time you plug it in. Now, signs point toward Android further restricting APK publication and installation?

Passkeys work because you always have the hardware for them.

Suppose I had only passkeys and Google Pay. I take a train into town and lose my phone. What then? I'm screwed.

I couldn't just go home because I'd need to buy a ticket or taxi using my phone. I couldn't buy a replacement phone. I wouldn't be able to online shop on a library computer or withdraw money unless I have a physical bank branch. (I do not.) I can't even contact anyone unless I know their number and borrow a phone or find a way to send an email.

My preferred balance of risk vs convenience is: passwords in a password manager, hardware-based 2FA only for making account changes, and confirmation emails (My email password is not in my password vault.) any time a site successfully or unsuccessfully processes a login attempt.

There is no hardware element. If someone phishes my password, I'll know right away from the login email, unless they're so talented or lucky that they also accessed my email or found a way to spoof my 2FA. If I lose my phone, I'm not totally helpless. I don't see an overall downside to my strategy that isn't worse than passkeys.

-----

Edit: One suggested alternative I can fathom is "passkeys managed by password manager". While this does provide better security than "passwords managed in a password manager", my experience has been that passkeys are not well-implemented across all platforms where they Just Work(TM) on every site. I don't know how you'd go about using passkeys in a shared public computer setting (university lab or library) unless you can install browser extensions (and why would you want to, even if you could?). At the end of the day, these passkeys are still secured by the password manager's single master password. Regardless of what I use, I want emails when a login attempt succeeds or fails. It takes one full second to swipe away at my convenience, and I would instantly become alert to an attempt or login I didn't execute.

I have so many questions of my own:

How many people see their ideal match and get humbled (or emboldened) by surprising results? How many of these try immediately to change something about themselves?

Since the match pool will never be exactly 1:1, do you do anything at all about the least matchable people?

Would it become possible to gauge whether changed answers are efforts to widen one's net or legitimate personal growth and/or a bit of self-reflection?

If the dating service detects deceptive answering, is it correct to just pair these people with other dishonest users?

Can you gather any feedback from unsuccessful dates and apply a "Je n'sais quoi" Factor to positively/negatively weight their chances when calculating their compatibility with future matches?

If you take this idea to the extreme, can you start to distrust negative date feedback if the feedback provider is shown to be unreliable? (Person A doesn't like anybody, their feedback shouldn't matter.)

Are there detectable signals of someone's Je ne sais quoi Factor in their profile metadata, including profile photo(s) and answering habits? (i.e. People answering the full survey in less than 15 minutes at 3 a.m. are 28% less desireable on average.)

While it's good to grow together with a partner, it doesn't always work out that way. How would such an algorithm be able to determine that an ambitious (broadly: likely to dramatically change) person will not be paired with a long-term apathetic, set-in-stone person? (I do realize they have the, "always working on yourself?" question, but there's so much this question leaves unanswered.)

Is this a ploy to get more applicants to join the government staff, if the pilot remains closed to the public?

(tying together "least matchable people" and "government staff") Do you start monitoring the extreme ends of matchability to see if there's a link between perceived social agreeableness and job performance? What was that again about detecting dishonesty and limiting the pool to government workers?

-----

One detail I particularly liked about early OKCupid was the ability to rank how much someone's answer mattered. For instance, I don't particularly mind someone's exercise and organization preferences, and it's fine if we didn't match because they DO have expectations from me in these areas which I fail to meet. I would hope the Singapore service would implement this as well, although a description of FirstDate in The Straits Times suggests this nuance isn't there.

Another thing the Singapore dating service has in common with OKCupid is at least a few poorly worded questions: "What’s a country that’s ruined all other countries for you?" is akin to OKC's "In a certain light, wouldn't nuclear war be exciting?" You can't split hairs as a Yes/No response in OKC, "sure: I would understandably have tons of negative excitement, a sudden spike in anxiety/dread, instantaneous long-term shift in priorities, etc.; although the use of atomic weapons thoroughly horrifies me," just like you can't explain whether the country that "ruined others" did so via greatness (Spain with its social and expressive population, food, beaches, siestas, and music) or by causing a loss of faith in humanity (Ireland, due to a stolen laptop plus being verbally threatened by a primary school-aged child while I was walking with a baby stroller).

My personal take on the nuclear war question? I just tried to optimize (cast the widest net) and decided, "Anyone willing to misunderstand this one question while also prioritizing and demanding its response is less likely to be someone whose company I value," and left the question unanswered + unimportant to me.

Now if only my local government had a "friends group" service, so I don't end up hanging out with other parents just by virtue of also being a parent and needing to be around them in the same places at the same times...

Ubuntu 26.04 regularly, automatically adds a duplicate of our HP network printers, using a slightly different driver and defaulting to Letter (the printer default is A4 and my locale is Ireland). If I try to print a label into a specific quadrant using Document Viewer, it slaps it in the top-left. At least once per week, jobs just disappear without reaching the printer. If you want to print images, you'd better learn ImageMagick incantations or accept whatever scaling and positioning lands on the paper. It's far easier to use the cloud services than to set up network scanning.

The Windows process isn't necessarily better (unless your only concern is reliability and you don't have a Brother) but it is certainly different.

Yes, games

Lenovo needs to fix the awful quality USB-C ports on modern Thinkpads.

Partner's mom lost phone. Partner called me with mom's password. I went to Find Hub. Entered email and password. "Hold on, we're sending the lost phone a verification text."

The article was clear and reflects my own opinions:

If you use an untrusted machine, you either revert to the least secure backup method (your master password in Bitwarden) or don't log in.

If your phone is your trusted device and becomes lost/stolen and then replaced, you revert to the least secure backup method e.g. password, security questions, or even waiting to be manually verified. This can be problematic if your online bank requires 2FA so you can purchase the replacement phone.

The QR + Bluetooth thing sounds dumb as hell.

Kiwi Browser doesn't support passkeys even with Bitwarden on my device. I have to choose between an inferior (for my needs) browser or passkeys.

-----

Rather than passkeys, which always rely on a trusted device, my preference is, "I use a password manager and site-specific generated passwords, and when I try to log in with only a password on your site, send me an email (whether pass or fail), plus never require 2FA except for banking and perhaps to change email/password"

It's unlikely I'll lose access to email notifications at the same time someone tries logging in with a phished password (except, obviously, my email password, which should only be changeable with 2FA) unless I am specifically physically targeted or astonishingly unlucky.

If someone uses a fake website or other MITM method to grab my credentials, I'll be fine because I'll get the "hey PennRobotics you logged in to crabcakes.com just now from a iPhone" message and then immediately triage that unexpected situation.

If I need to log in to a website in private mode or on a different device, it takes an extra 30 seconds to log in to my password manager plus no device dependency.

-----

The passkey problem for me? You need some hardware or else it's glorified 2FA or even (in the case of the Paypal app) 1FA applied twice, and as soon as you lose EITHER the hardware or the "what you are/what you have" part of 2FA you enter a world of trouble.

Also, ToS lockouts happen. When Google terminates your account (for any variety of imaginative or realistic reasons) there isn't really any method to use or export your passkeys anymore.