piaste

> What about if the worker crashes whilst in the middle of copying over some rows from a number of large Excel spreadsheets?

You don't need a nonce at all in this case.

The purposes of nonces is to make non-idempotent requests into idempotent ones.

"Write 'lol' in sheet 1, row 5, column B" is already idempotent.

> You can't have idempotency without determinism

You absolutely can. The idempotency nonce must be generated by the client who is responsible for firing potential retries. And a random UUIDv4 is a perfectly fine nonce.

If the client _doesn't_ generate a nonce, it doesn't matter what the server side does, they cannot tell from the request data if it's supposed to be a retry or a new request with the same data. A hash such as a UUIDv5 is more performant but not logically any better than comparing the raw data of the two requests. If you use that UUIDv5 as your primary key for insert/update, it's little more than a natural key, with all its well-known drawbacks.

Which still doesn't make it Mullvad's political position.

I immediately emptied my account with BBVA (a major bank with $37B yearly revenue) after their app asked me to validate my identity by entering "the fourth character of your password". Subsequent attempts asked for different ordinals. This was in 2023.

That just means the hash is effectively the real password. If an attacker gets a hold of the hash that you transmitted, they can use that to authenticate to the server.

All that you gain by transmitting the hash, is that the attacker will need to modify the client's request to inject the stolen hash.

If the client (website or app) runs on the attacker's own devices, this is trivial. I suppose it is a valid obstacle if we are talking about an ATM or similar locked-down client.

You can (and should) do the same with passkeys. Like SSH keys, they're just text.

Save a passkey in Bitwarden, then export your vault as JSON. You'll see a nice plain text JSON block with your passkey that you can print, or backup, or import into whatever replaces Bitwarden.

Bitwarden browser extension, and I imagine most other password managers, will only offer to auto-fill a password if the site matches. There's a setting to choose the exact rule, but the default is matching the domain name.

So if you get sent to goog1e.com, your password manager won't prompt you to enter your Google passwords. Though of course, you could still manually paste it in if you got somehow convinced that it's a legit site.

> Some people here are defending Mullvad's political position.

It is not Mullvad's political position. It is the political position of one of its co-founders, using his own money. The other co-founder openly disagrees with that position.

Personally, I feel _much_ better about relying on a company whose two co-CEOs have diametrically opposed political stance, than I would about a company with a singular one.

Are you using a VPN? Youtube will be a jerk to those IPs. I need to set my exit node to either Poland or Albania to watch YT. (The latter incidentally is supposed to act as an ad-blocker due to local legislation banning some types of ads, but I have my own ad-blockers so I cannot confirm.)

No. The simple relay thing only works if you can trust that they aren't comparing notes. But if I could trust them not to do so, I would already trust them when they say that they do not log your identity.

ZKPs allow you to be the relay between Chase and Pornhub, and you know exactly which data is shared between the two. Chase would obviously have no idea whether you used the certificate for Pornhub or anything else; and Pornhub will know that their request was validated by _a_ trusted ID provider, but not necessarily which particular one out of a group (issuer-hidden ZKPs).

> Multiple different XBMC forks. Multiples different Subsonic forks. Multiple different DNLA servers. Multitudes of web-based servers. CLI MP3 servers.

Big difference between _audio_ streaming and _video_ streaming servers. Video streaming is much more complex and pretty consolidated, as I mentioned.

Audio streaming is much more manageable: no issues with transcoding, acceleration or subtitling, and a radically simpler UI. Also ID3 tags aren't great but they're a pretty universal standard with lots of databases, you don't need to desperately scrape IMDB/TMBD for info.

As a result there are quite a few music servers, often exposing Subsonic compatible APIs, ranging from the minimalistic to the 'I'm trying to do everything Spotify does'.

I think it's just a pretty consolidated space? Kind of like ebook management, which was dominated by Calibre for so many years (this changed recently).

But unlike ebooks, media centre management is a fair bit more complex since it involves supporting many different media formats and many forms of acceleration or transcoding.

So the big projects - Kodi for local media and Jellyfin for streaming - have a lot of inertia because they tend to support whatever you throw at them.

> Why not switch it around?

Because a malicious human will gladly copy/paste LLM text and sign it with his "I, a human, definitely wrote this academic paper" key?

I tried to switch to nushell full-time but couldn't stick with it.

Ironically, the main friction point were not old-fashioned tools (which `from ssv` usually handled nicely) but the 'new generation' of core CLI tools like eza or fzf. They have really nice visualizations, but they do not output structured data as a middle step, so all the colours and lines only play havoc with nu's parsing.

Since I need to "ls" a lot more often than I need to do data manipulation, the tools won and I went back to zsh. Still keep nu around for the occasional config/data file wrangling though.