garrettr_
Joined 11 years ago
Karma
841
Submissions
88
Member since
Mar 23
Recent submissions
Comment · 2 days ago
Comment · 1 month ago
Similarly, I had to stop using Zed because the main thread would beachball for > 30s when trying to work in large repos on macOS. This behavior was clearly reported to them in a GitHub issue that they also closed without fixing (because they believed a partial fix was sufficient, and have ignored subsequent comments to the contrary): https://github.com/zed-industries/zed/issues/55746
Comment · 1 year ago
EVs are heavier than similar ICE vehicles, but they also have regenerative braking, which greatly reduces wear on the brake pads. I suspect EVs produce much less particulate pollution from brake pads, but somewhat more from their tires.
Comment · 2 years ago
Go to the left sidebar, open the dropdown menu labeled with your account email at the bottom, click Feature Preview, enable LaTeX Rendering.
Comment · 2 years ago
w.r.t SQLite, the only horrifying revelation I’ve had is that it allows NULLs in composite primary keys, which I’ve seen lead to some nasty bugs in practice.
Comment · 4 years ago
Exporting is purposefully made impossible in many implementations of Passkeys (aka Webauthn authenticators) other than Apple's. For example, Yubikeys are designed so private keys can never leave the authenticator [0]. Enabling the export of private keys from an authenticator greatly increases the attack surface of an authenticator.
This is a long-standing security/usability tradeoff in the Webauthn spec. Various solutions have been proposed, but as far as I know most of them are still just drafts, e.g. [1]. The best practice has been and, as far as I know, continues to be to register multiple authenticators, e.g. a primary and a backup authenticator. This practice has a variety of benefits:
1. Avoids lockout if an authenticator is lost.
2. If you use multiple authenticators from different vendors (e.g. Yubico and Google) you:
1. Avoid vendor lock-in
2. Can rapidly respond in case a security vulnerability is discovered in one of your authenticators, as has occurred for both Yubico [2] and Google [3].
One could use Apple's Passkeys as one's day-to-day "personal" authenticator, and use an authenticator from a different vendor (e.g. Yubico Yubikey or Google Titan Security Key) as their backup key. I don't see how Apple's implementation increases the risk of lock-in beyond that of any of the other major Webauthn authenticator providers.
[0]: https://github.com/w3c/webauthn/issues/865#issuecomment-3804...
[1]: https://github.com/Yubico/webauthn-recovery-extension
[2]: https://www.yubico.com/support/issue-rating-system/security-...
[3]: https://security.googleblog.com/2019/05/titan-keys-update.ht...
Comment · 4 years ago
Paste (https://pasteapp.io/) has this feature too.
Comment · 4 years ago
There's a striking similarity between the author's mockups from Feb 15 and the redesigned System Settings announced in the beta of macOS Ventura and last week's WWDC [0]. I guess they got their wish!
[0]: https://www.macrumors.com/2022/06/06/macos-ventura-system-se...
Comment · 4 years ago
Regenerative braking
Comment · 6 years ago
There are numerous Firefox add-ons that provide this feature, e.g. https://addons.mozilla.org/en-US/firefox/addon/leechblock-ng.... IMHO, the main benefit of using Safari/Screen Time for this is that it automatically syncs the same limits across all of your iCloud-connected devices, which is great. I know Firefox has a Sync feature but I'm not sure if any of the add-ons leverage it to provide a similar seamless cross-device experience.
Comment · 6 years ago
> I don't know what you mean by "Firefox doesn't enforce [CT]".
They mean Firefox, unlike Chrome and Safari, doesn't require proof of inclusion in a CT log for recently issued TLS certificates to be considered valid.
Source: https://developer.mozilla.org/en-US/docs/Web/Security/Certif....
Comment · 7 years ago
The jobs.apple.com link appears to be broken :) It doesn't link to a specific job description, just an empty search form with 100s of results.
Comment · 7 years ago
Project Zero also regularly publishes on flaws in Google's own products. Check out https://googleprojectzero.blogspot.com: they do a fair amount of reports on Chrome, ChromeOS, Android, etc.
Comment · 7 years ago
I was recently asked by a friend who teaches 5th graders to do something similar for their school's "career month." I tried a few different things, and found the most successful was showing them how to use a web browser's built-in developer tools to inspect the source of and make live modifications to web pages.
My reasoning behind this exercise was:
- I checked in with their teacher ahead of time and confirmed that all of these kids had a least some experience using a web browser. Generally it seems like a likely "lowest common denominator" of tech experience for kids.
- Most web browsers have powerful developer tools that can be used to inspect and modify source and will display the results of many types of changes in real time. It is easy to get kids to understand the relationship between HTML/CSS code and the webpage that results from rendering it when you can make live changes to the code and see it immediately reflected in the rendered page.
- Web browsers are freely available. I gave them a handout with instructions on how to access the developer tools in web browsers that are either free (Chrome, Firefox) or readily available to them (Safari, since their school computer lab had a few Macs). I specifically wanted them to be inspired and continue experimenting after I left.
I concluded by spending 10 minutes taking student's requests for the modifications to nytimes.com. It ended up with a bizarro color scheme, comic sans on all the things, and pictures of dinosaurs and Pixar characters at the top of every article. Everyone had a blast, myself included!
I think the demonstration tickled the kid's innate predisposition towards mischief. An immediate question was "can everyone in the world see this changes? are you hacking right now?," which allowed me to naturally give a high-level explanation of the server-client architecture of the web. A few kids came up to me afterwards and asked me to specifically walk them through finding and opening the developer tools so they could continue experimenting at home, and that was the best outcome I could've hoped for!
Comment · 7 years ago
> It's a video with no transcript
While Apple only started posting transcripts of WWDC presentations last year, https://asciiwwdc.com has been around for a while and is a great searchable archive of WWDC transcripts. Here's the transcript for the presentation you referenced: https://asciiwwdc.com/2014/sessions/715?q=user%20privacy%20i....
It’s a slim volume that focuses on historical and fictional ciphers. It stars with simple shift ciphers like Caesar’s cipher, progresses to more complex substitution ciphers with examples from Sherlock Holmes and Edgar Allen Poe, then covers polyalphabetic ciphers like Vigenère and Playfair. It covers basic cryptanalysis and has practice riddles and cryptograms throughout. It even has a chapter on a variety of ways to make invisible ink, which is often an object of fascination for children around that age!