TheSwordsman
Joined 14 years ago
Joined 14 years ago
Sure, with well written prompts you can have some success using AI assistants for things, but also with well-written non-ambiguous prompts you can inexplicably end up with absolute garbage.
Until things become consistent, this sort of generative AI is more akin to a party trick than being able to replace or even supplement junior engineers.
I also hope they have a good support contract with AWS, otherwise they are going to be in for a fun surprise when ECS has some weird behavior or bug.
Although, considering the author mentioned a loan with a partner maybe they were trying to rebuild it in Google Docs or something so they could more-easily see it together.
So in terms of comparisons I don't think you're wrong, but it might be better to compare it to the F-150 Lightning for more of an apples to apples comparison. The F-150 Lightning Platinum vs Cybetruck AWD is probably the most fair comparison in terms of specs, but the CT is ~$20,000 cheaper
If we compare the F-150 Lightning Lariat with XR Battery to the Cybertruck AWD, because of price:
F-150:
Range: 320mi
Towing: 7,700lbs
Curb Weight: 6,361lbs
---
CT:
Range: 340mi
Towing: 11,000lbs
Curb Weight: 6,603lbs
---
F-150 Lighting Platinum to CT Cyberbeast, because of price:
F-150:
Range: 300mi
Towing: 8,500lbs
Curb Weight: 6,893lbs
---
CT:
Range: 320mi
Towing: 11,000lbs
Curb Weight: 6,843lbs
If you use a token generator (Google Authenticator, Authy, or the one built into products like 1Password), a shared secret key is used to generate the MFA token. You store this secret in that software, and it uses the current time + that secret key to generate the MFA token.
This is a far better mechanism than the SMS or phone call based approach. And in this mechanism you can store the secret in any software that's able to generate the token using that algorithm.
Most commonly it's this algorithm: https://datatracker.ietf.org/doc/html/rfc6238
If someone compromised your password store, then yeah it's all over. But if the compromise happens elsewhere, it can be a useful layer to the security onion.
So I think there are a few potential issues with this argument based on assumptions you're making. I'd argue this isn't entirely true because:
1. Many password managers allow you to manually copy the password into your clipboard, which mean you could paste it somewhere that's unsafe / untrusted. Someone could then use this password to authenticate as you. Many sites disallow token reuse, so once used if you accidentally pasted that somewhere as well an attacker couldn't reuse the token.
2. Similarly, if someone has managed to exfiltrate login details you provide without being able to also obtain the session cookie sent back, and the site enforces one time use of MFA tokens, then the MFA token can also avoid a replay attack of your login details.
I'll admit the second one may be a bit contrived, because if they can exfiltrate login details it seems likely they could also just obtain the session cookie. But if said cookie is tied to a certain IP address, then that cookie is useless to them and they wouldn't be able to replay the credentials.
I didn't pass the bar, but I know a little bit. Enough that you won't illegally search my shit.