justsomeadvice0

I think GP intended to convey "under the price in the article" ($83/kwhr).

IIRC macOS got rid of privileged ports for these reasons. Dunno about iOS... But in any case what cell provider is going to let you handle inbound traffic? Most of the wifi networks you are on are NAT'd, etc. At best you'd probably want an outbound persistent tunnel that is "terminated" by a relay elsewhere. At that point you might as well just have the relay host the thing.

Yea, agree with this guy. Anyways I took "novel attack vector" to just mean "first time we've heard of using SSPR against AD". They even used the existing acronym "SSPR", so they're not claiming to have discovered the attack vector or anything.

They just claim to have identified abuse of an "SSPR" attack happening against Azure AD in the wild. What part is a lie?

A long time ago I wrote a variant of this - the signup page would generate a token, place it in a hidden password field, submit a hidden form, and instruct the user to click the "Save password" dialog in their browser. One advantage of this was e.g. Chrome would sync the password immediately across all your devices (in some ways this was a privacy violation, although one that the user had to explicitly opt themselves into). New sessions (e.g., if you reset or lost your browser's stored passwords) still happened via email verification, though.

Today I would just use passkeys.

> doing basic entropy checks on a user-provided password pretty much solves the issue anyways.

No it does not. Users will find one high-enough-entropy variant of their password, and reuse it across all sites for life.

> Authentication is pretty much a solved problem

Hrm. It might be solved for you and users like you - but it depends on your site's demographics: most internet users on the whole will not know anything about encrypted "password lockers" and "physical Webauthn tokens". Browser-managed passkeys, on the other hand, stand some chance of being easy enough to use while enforcing good security and high entropy secrets, but lack widespread adoption so far.

You can use mTLS client certificates (kept in the system key store) in browsers this way; but the UX is pretty hard to get right, and certificates nearly always have to have an expiry date to deal with the compromise-able nature of keys imported into the system key store.

> Social media networks with over 100,000,000 daily active users should not be considered as "private companies with a right to free speech through censorship". They are effectively public squares that we have all elected and chosen to share. Right and left alike.

Shouldn't this also apply to TV channels? Chat apps like iMessage? Popular newspapers, blogs, and email newsletters? And indeed, why stop at 100M DAUs - why not 10M, or 1M? The problem I expect is this path leads to the death of freedom of the press.

It took me a while to understand what you were talking about at the end there. I think the author is referring to a grammatical period ('sorry' vs 'sorry.'), not the menstrual kind, lol.

This strikes me as a very strange opinion, especially now when Threads has 100M users 5 days out and is expected to support ActivityPub. In any case: since the beginning, pointing and laughing at Mastodon (a single AP implementation) was always like saying "Yahoo Mail will never win the electronic messages war!!" - it misses the point, like, entirely.

Trying to be fair here - it's technically not linked to any blockchains. It's just (ab)using the cryptographic primitives provided by the Metamask wallet app to sign things with a key stored in the wallet. That key might (probably) also be used to sign things that end up on any sort of blockchain, e.g. ETH.

The reason to do this is some people do indeed have Metamask (a browser extension, yuck) already installed and a wallet set up - so technically this might be an easy way to enable signing for them.

The reasons not to do this, I already detailed above. It is a neat hack, that would fare tragically when applied to the masses.

Because they clicked a button in this incredibly intuitive UX that said "Sign wiki edit", and then clicked "Confirm".

I think you massively overestimate most users' grasp on cryptographic primitives...