dsl

If you are blanket accepting permissions passkeys do nothing to fix the attack you describe (on device phishing).

Passkeys are not about securing things.

The entire value proposition, and the reason big sites are pushing them, is they take the user out of the loop of authentication. You are no longer authenticating the user, you're authenticating the users device.

For websites you don't have to worry about cookie theft and dealing with the support load of users needing their accounts reset or dealing with fraud. You can also do some level of attestation to hardware which makes automated account creation more difficult.

For the user it offers no additional benefits. You still have something secret that gets presented to a website to login. Password managers solved this problem. But now for some reason you can't log in when you buy a new laptop.

Warren Buffet made the largest single tax payment in US history last year. He doesn't play any games.

Telemetry is used to push service, which is the big money maker for dealerships. Roadside assistance, maps subscriptions, driving data for market research.

Selling it is pure icing on top.

I spent about an hour looking at the code and found some glaring issues that should be fixed before trusting it with real money.

- Yahoo News is introduced twice (sentiment and news analysis) which double weights it

- Sentiment analysis prompt primes the model to be bullish on Nvidia.

- In the self learning loop there is a complex parsing bug that results in hallucinated memories when agents return truncated responses

- You can completely control sentiment analysis of a subreddit by simply maintaining a majority of the 5 most recently posted messages, regardless of any quality metric

- The reflection prompt states the agent must cite alpha, which in a market wide downturn causes it to think correctly placed calls were losses

Authentication was never the problem, transport security was.

This is why we pushed to deploy TLS everywhere instead of focusing on a scheme to PGP sign every webpage on the internet.

That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then.

DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents.

We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.

I think the comment you replied to was referring to the fact that when Twitter was taken over the entire Trust and Safety team was done away with. This has allowed child sexual abuse material to flourish on the platform.

In naive implementations like Grok that is exactly what happens.

> but are they functionally useful or helpful to anyone currently?

I've been building a SaaS that deals with data that can't be distributed to third parties. Some of the useful AI stuff I can add is not time sensitive and can run overnight. Things like this allow me to use higher quality models without selling my house for GPUs.

Seeing as Apple is sunsetting a program that is far superior as a consumer, the two are not unrelated.

General compute is also the worst solution to the problem.

Nvidia's entire business is dependent on Google not being able to make TPUs fast enough.

Put simply government officials created a scheme to buy up a bunch of unused water rights, then use state and federal dollars to pay themselves incentives to continue not using the water.