erinaceousjones

I heard it's been a difficult project to justify spending the research/computer time on at scale, because the models use an equivalent amount of compute for training and inference, but more parallelizable. So 5 times more compute units can be required and they get the work done 5 times faster. On a Google scale, that meant the hard internal sell of justifying burning through $25 million worth of compute units over 1 day instead of $5 million each day for 5 days. Something like that.

Technically Pixel 6 has the pKVM feature too (I have the terminal app from the feature drop when it was added). We're just missing DP alt mode introduced from Pixel 8 onwards

I do wonder if part of it is down to Android default animation speeds.... Pixel 6 here, Gboard snappy enough. Something I do on every android device I own though is go into developer settings and change all the animation durations to 0.5x. Makes stuff seem snappier. In reality I'm sure it's dropping just as many frames as it async loads garbage enterprise uncompressed asset icons or whatever, but hey it shows up on screen 2x as fast!!!!

Edit: oh, no, you have a point about the UI blocking stuff, it's fine when apps are loaded and active but "cold booting" a UI component definitely has lags in stupid places, android UX feels like a web perform sometimes due to that.... Tap button, go on holiday for a week, come back and it's responded to the button press (while you were trying to do something completely different and now you've pressed something else and you're not sure what because this time the button you pressed closed the activity overlay 1ms after)

it's pronounced more like "cutch" (well, for me it is anyway) :))

if the name bothers, it can be forked. looking forward to "yCont" messenger!

Reading through their guidance they don't really mention anything about password strength indicators being a good or bad idea. Sure, they list out a set of rules to verify passwords by and state no OTHER arbitrary rules should be included. But that doesn't prevent you from calculating password strength based on the rules they specify ie. minimum length and complexity.

But I get that "strength" is a poor metric. It shouldn't allow "weak" passwords. It should be binary - pass or fail.

The nicest thing about strength indicators - and I reckon this is why they are copied a lot - is that they are usually real-time feedback to the user with a nice red/orange/green invalid/weak/strong indicator that updates as the user types. The best ones even go as far as show you the list of rules your password is failing to meet, again updating as you type. Much much nicer than the server-side validation form submission loop imo.

So, remove the middle concept of "weak but allowed" passwords from the strength indicator widget, I think then you get good UX that meets NIST recommendations..?

Thankyou! I checked with IPQS and my residential IP had been flagged for being "a proxy". I routinely SSH VPN (sshuttle) into my home network to do things so maybe that's why.

That's inconsistent messaging from Corsair, then. Parent comment quotes the times they're like "ehh, they're same thing, don't worry about it" and then they go on to say "well TECHNICALLY there's a teeensy difference in conductor sizes"???

Either they are confident that the 0.25mm terminal difference is within tolerance enough that they consider 12VHPWR to be functionally equivalent to 12V-2x6, or they're getting themselves confused let alone the target audience of their article.

I think it's unfair this comment has been flagged or downvoted or whatever. It's pragmatic information!

The mobile hotspot thing... I have to do that to do anything involving Okta.

For some frustrating reason my IPv4 address, which I pay extra to my ISP to have, has been blocklisted by Okta. A login flow failure in one of the apps work uses triggered my address getting banned indefinitely is my best guess. My works Okta admins don't really understand how to unblock me on their Okta tenancy, and Okta support just directs me back to my local admins (even though it's any okta-using org I'm banned from logging into).

I get that misuse/abuse detection has to do its thing but it's so frustrating when there's basically zero way of a legitimate user from an IP of undoing a ban. My only recourse is to do all my using of okta from another IP.... If I was a legit spammer I wouldn't think twice about switching to another IP from my big pool, probably.

Thanks, I'd not found these yet! Very helpful :)

> Until you know more, strongly consider suggesting the company just hires someone who knows that. Just because you're available to do it, doesn't mean you should just yet.

This is a fair point. We'd always find it difficult to hire someone who was 100% specialising in software security / crypto etc, but a software eng who has some experience would probably be palatable... But funding for new hires could be a couple of years out. That, or we find a way to turn it into a research proposal we can sic a PhD on.

Still, I think it benefits us to have a strong baseline knowledge of crypto systems as a team, "bus factor" and all that. Maybe one day we have a colleague that can teach us that, but until then we may as well crack on with self-teaching :-)

I'm in that boat. I'm watching all of Christoph Paar's cryptography lecture series on YouTube -- it was recorded in 2010, so I do wonder if it's missing any new state of the art / best practises.

I'm like 18 lectures in, two out of three semesters. And I still feel like I have only the vaguest ideas what the primitives are, how they work, what they're for, and their weaknesses. I'm having to follow all the mathematics as someone not mathematically inclined (Prof Paar did do a good job of making the mathematics fairly accessible though).

All of this so I can have a bit more confidence in proposing E2E for a project at some point in future (before somebody asks us to, too late).

And my use-case makes it difficult to follow the most trodden paths so I can't just plug in a handshake protocol and MACs and elliptic curves or "just use PGP" or whatever.

As a software dev, I have all these boxes I could use, that come with so many caveats "if you do this, but don't do this, no do that, don't do that"... It's very tricky trying to work out how to glue the pieces together without already being in the field of crypto. Feels like I'll always be missing some crucial piece of information I'd get if I pored over hundreds of textbooks and papers but I don't have the resources to do so!

I'd love if someone did like, a plain English recipe book for cryptography! Give the mathematical proof of stuff, but also explain the strengths/weaknesses/possible attacks to laypeople without the prerequisite that you need to understand ring modulus or Galois fields or whatever first. Or, like, flowcharts to follow!

Huh, I'm in the UK and certainly every time one of my workmates has said "to table" something it's meant "let's stop fucking talking about this now"

Chromecast Audios are still easy to pick up on eBay (or if you're in the UK, CeX, that's where I got one).

Any old cheap plug tied to Home Assistant (or plain old Google Home in my case) for auto powering on my Cambridge Audio amp. (I'm not fancy enough to care about automated input switching between TV and music, I just get up and turn the knob, but turning off the hifi remotely I like)

Music Assistant supports streaming to Chromecast from TIDAL at the native (24 bit, 96khz, flac/m4a?) format. And TIDAL mobile app itself supports casting to Chromecast devices as you'd expect.

Those 3 things combined got me an old school hifi set up which I can include in my Chromecast groups of shitty sounding second-hand nest minis, so I get multi room audio where one room has the most audio :-) but I could swap out the shitty pucks for some more CC audios if I wanted to fork out for more amps and bookshelf speakers.

I trust Google to at least not intentionally brick their old devices and chromecast is built on mDNS and documented http endpoints enough that you can automate your own stuff in your LAN that you should be able to keep that stuff working in home assistant + music assistant should Google ever decide randomly they wanna sunset Google home (so, 50% chance of them announcing that in 2025).

Homebrew you can roll your own DIY multi room hifi audio using stuff like Hifiberry, too. Pipewire/PulseAudio/JACK on raspberry pi / NUCs should be able to get you surround sound over the network with minimal latency (although you probably want decent ethernet), since you can make a virtual sink that bridges the audio servers together.

You have one of those fancy hifis that has hdmi inputs and digital input selection and whatnot? Okay yeah you'd have to roll your own HDMI CEC automation again with a raspberry pi or whatever. Eminently doable.

There's definitely ways to get multi room audio of equivalent or better quality and at-least-equal user experience as long as you're willing to invest the time in doing loads of DIY shenanigans, but honestly it's pretty easy these days. For me, I think the "this is too complicated for me to implement" bar is not high enough to warrant buying Sonos