Vexs

> buried vias

Buried vias are /super/ expensive from any board house- and very uncommon in most prototyping designs as a result.

Obviously a bit different if you're doing boards with super dense BGA layout chips, but even then you can usually avoid it.

> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

Am I missing something? "Attestation tells websites what the authenticator is but it doesn't tell the website what the authenticator is".

The entire argument in this blogpost amounts to "nobody would ever turn on passkey attestation because it would require migration of people who already setup passkeys" which is a questionable argument- you could trivially imagine allowing unattested passkeys for existing users, but require it for new users. Most websites don't yet support passkeys to begin with, so this argument doesn't hold for the majority of websites.

The "biggest providers" bit at the end is odd too because the biggest providers are apple/google- who, as far as I know, do support attestation.

>contemporary clothing, designed with beautiful cuts forming interesting silhouettes,

as someone with a recent interest in this, do you have any pointers?

I see asserts used in production code as part of flow control way too frequently, so I assume the majority of python users aren't aware of the -O flag, much less this behavior- which I too haven't ever heard of. Of recently, I've noticed claude is a big fan of asserts too.

Observationally, for people that /aren't/ using models to code but to just do their white-collar job, claude.ai /is/ AI, now. The entire perspective for how to use AI is through claude skills, claude projects, claude cowork, etc. They've massively won the corp buy-in at the moment I believe.

> You have to review the source of every PKGBUILD from the AUR you install, full stop

I don't really think this is a solution- the usual workflow for these attacks has been to hide your payload in some dependency. This one is somewhat unusual in that it's just a very lazy `npm install` in the pkgbuild. Pretty much every package repository even outside of AUR has this issue now, and it's not really viable to audit the entire dep chain by hand. Mind you, I don't have a solution either.

Published CVEs seems a bad metric to use for this- unless we assume that the ratio of really nasty vulns/not-too-bad vulns is consistent.

It's worth reading this one to the end- the point of this paper isn't about the math involved, it's that this math was the result of the federal funding of maths research.

> The cost-benefit ratio of Mathematical research has been off-scale. The Federal government spends about $250 Million/year on mathematics research. Yet in the US there are 40 Million MRI scans per year, incurring tens of billions in Medicaid, Medicare and other Federal costs. The financial benefits of the roughly 10-to-1 productivity improvements now being seen in MRI could soon far exceed the annual NSF budget for mathematics research

Some time ago I wanted the original MS solitaire playing card files. Wasn't too hard to find a copy of the binary, but the interesting thing to me is it appeared the files were handwritten- a couple possible typos in color and not a single byte longer than they needed to be.

You don't. The normal procedure here is to have multiple unique keys with multiple unique secrets. If one breaks that's it it's broken. This also allows you to revoke a key without removing all keys.

It's not even just that- with component selection you have a handful of datasheets that give you (ideally) fairly truthful information about the device. You can rather deterministically look at these and compare them.

Regular consumer products? Good fucking luck. Anywhere an LLM pulls from is probably going to be mostly SEO'd listicles.

Buddy you've got like 10 top-level comments on this thread are you doing okay

You could pretty reasonably vibe code that in a single prompt odds are.

Additionally, there are browser extensions that can do this- check on a timer, see if some page content is there, and then notify.

They're also, as it turns out, vulnerable to a drillbit

The only thing that seems to have gotten a lot worse is the trend of ai articles- which isn't kagi's fault but it would be nice if they could figure out how to filter them. They all follow the same patter- "specific thing you want" with a table of contents with loads of repeated chapters and unrelated information, spattered with effectively random images.