coaksford

What is the "this" that we get through by disclosing unpatched vulnerabilities that aren't evidently being actively exploited in the wild before the vendor can release patches? I'm trying to be charitable and figure out what that could refer to and drawing a blank.

"...if attestation is the thing you're worried about, the post's own recommendation pushes you towards attestation rather than away from it!"

It is plainly obvious that the worry isn't attestation per se, it's the restrictions that attestation may in the future require when they turn the dial on restrictiveness up, that was extremely clear to me from reading the first article. If you can get attestation without those restrictions, "sure, why not", and a Yubikey seems like a way to do that which could avoid those restrictions. Most of this article makes sense, but this particular line makes me wonder how the author got it so far off the mark.

They also did nothing to quell my fears that they will in the future use passkeys to prevent people from using software they can modify themselves by saying "...the guidance for consumer sites has been to not even request attestation for years now." as if everyone always followed the guidance, and as if there aren't tens of thousands of managers that think their case is special and they really do need the extra control because they're a bank or handle copyrighted content or have PII or PCI and feel extra risk-averse today.

I don't know if they failed to do so because they can't (and this is a valid fear of the original author) or if they just are bad at reading the room at what the concern is and vastly overestimate how much people trust companies to always have their best interests at heart.

What I am getting from this, though, is "If you authenticate with a yubikey then that's attested, so they can't use attestation through passkeys to make sure your OS and browser aren't modified", and I'm not sure if that's the correct take away or even a correct statement.

At some point you don't want people to enter the bee movie script, but where the word "bee" was replaced with the entire bee movie script again, recursively three times, all into the password field and tie up servers with extremely long requests.

But 20 characters is simply ridiculous.

All my worst experiences with password length have been banking and finance and it boggles my mind that they all get something so incredibly basic so incredibly wrong. What is it about this sector that makes it so?

This isn't categorically true either, the real world is delightfully complicated, far more so than you imagine. The way cars interact within a road, as they enter an exit the road, or how they choose their route can all create conditions where adding a lane only makes traffic worse and can reduce both speed and volume during peak traffic hours.

Whether you mistrusted and were betrayed by that trust is binary, but that's like if someone says "radioactivity is a continuum" and you say "I either got hit by a gamma ray or not" as if that settles the question. Really the question was more like "what's the mean time to betrayal?" or "how big of a payoff can someone be trusted with before they have a 50% chance of betraying trust?" or "am I more or less confident that this person can be trusted in this situation?" or any of a dozen other obvious ways that people who seriously consider the issue of trust do so. If you think the binary states are absolute trust and absolute paranoia and there is no in between (as having any in-between makes it a continuum) then you've got a conception of trust that nobody else in the world finds seriously useful.

It could be that the Gimp team and community are so self-selecting, defensive, and idiosyncratic that they drive everyone else who wants to change (read as "improve") it out of the team and community before letting them do anything to fix it. Gimp stands out among applications I've used as having enduring bad UX for decades, and it's hard to imagine a reason for it other than that efforts to improve it are unwelcome. Even Blender, which I once thought was the only thing worse than Gimp, has successfully turned that around. The reputation that Gimp has for its poor UX is not a random coincidence that a cursed meteor struck it of all open source projects, it's an enduring social problem with exactly that team and community that has earned it that reputation. This enduring social problem won't be fixed by this attitude of "we want it a certain way", that's just defensiveness displacing the critical thinking that was actually needed all along.

The suggestion to fork it is in bad faith. A fork goes nowhere unless a critical mass of the development community goes with it, and if you've already driven away the critical mass that could sustain a fork, that can never happen. Don't worry, Gimp is safe, I don't think anyone organized enough to fix its problems thinks it's worth the effort anymore, they're all working on other things instead.

As someone who very reluctantly fits that description, yes but no. I don't love FreeBSD any less or want to use it any less than anytime in the last 20 years, nor do I like Linux any more than at any time in the last 20 years (less, if anything). But NixOS is the "killer app" that has me on Linux instead of FreeBSD. If either FreeBSD gets a really good NixOS-like setup, or Linux-based NixOS becomes unmaintained, I'm happily going back to FreeBSD again, it has always been excellent and stable to me.

If they can get what they want from this, they will not stop after they get it. Even if the authors of the law want it to stop here, their successors will not, and will build upon this to erode privacy. When governments can change the deal effectively unilaterally, as is the case, you cannot make a deal with them that they cannot change, and you will have already surrendered the strongest argument against the next "deal" they want to unilaterally impose. Do not treat this as a deal to prevent further erosion, that is not what this is, treat this as an attack and attempt to advance against privacy and anonymity. Treating it as anything else is absolute gullibility.

I have never used Oh My Zsh, but I use Atuin to do this and it works excellently at that. You can even make it filter by what folder you're in and whether you want to search only this session or host (you can sync shell history across hosts). It never occurred to me that this is something I'd want from a shell prompt, which is what Starship is.

BSD was mired in the uncertainty of a lawsuit over some of their code at the time that Linux was getting started, and the FUD around that gave Linux a head start that BSD had up until that point, so you can't infer much about the reasons Linux's early success over BSD through that fog. If Linux had been dealing with the same problem that BSD had instead, BSD almost certainly would be in Linux's place right now.

Before the AI craze, all the GPUs were being bought up by cryptocurrency miners, and I'm not sure that's better. Even as an AI skeptic I think AI is a better use of all this hardware than cryptocurrency.

I wasn't sold on face ID until winter, and then the appeal become viscerally obvious.

Don’t worry, it wouldn’t replace your human boss, you’d just have both bosses.

I think the meaning was not "You can import used cars without tariffs", but "If you buy used cars already in the country, you don't pay the new tariff, so just don't buy new cars."