sholladay

He lived long and prospered.

Those are good reasons to have the machines network connected. They are not good reasons to have the machine internet connected.

There’s so much FUD out there about Passkeys. They are barely any different from the keys you use to push to GitHub. It’s all going to be okay.

Yes, they have some window dressing and opt-in features that extend the basic concept of asymmetric key pairs. Attestation is only in the spec to appease some large enterprise users for very specific scenarios. Signature counters are in there too, but since Apple decided not to implement (which I’m fine with), they are essentially irrelevant in the general case.

In practice, Passkeys are really quite simple.

We can do this, people. We can move beyond the era where poorly protected password databases are handed around like candy.

I loved early Deno and am sad to see it die. I invested heavily in the Deno ecosystem because of Ry’s initial vision for it.

But I stopped because I saw this coming the moment they changed course and started putting npm compatibility as a priority. Deno’s surface area went from beautifully simple to very bloated. I think they felt the pressure of VC funding and just gave up on rebuilding Node from first principles.

The silver lining is that early Deno was so good that Node copied some of its features. So at least we have a better Node now.

It feels like Cloudflare deliberately wants to do everything except for EC2. Which sucks because I would switch over a lot of systems from AWS if they would just do it.

It is, but in casual conversation, “government” often means the people/party currently in power (of the executive and/or legislature).

You can see this when people say “[X] is unable to form a government”. They don’t mean unable to form a judiciary.

A lot of times, people just need a gentle nudge, or an official blessing from an authority figure, to go ahead and make the change that is necessary. You can tell people to manage up, to fully own their work and their process, etc. But a lot of humans don’t want to step on others’ toes or be perceived as acting out of line. A worker on the assembly line might know the best way to make the line run more smoothly but it’s easy to think that’s “not my job” or “above my pay grade”. Sometimes all that’s needed is to tell them, “Yeah, go ahead and do it.”

Getting that to happen more automatically is one way out of this situation, but that tends to cause problems of its own, with blurry lines of responsibility and authority. So it works best with relatively flat organization structures, which aren’t used much in large organizations.

A lot of GitHub’s secondary features are like this. The Issues tab and Discussions tab are so similar, with slightly different feature sets. And users will happily use both for feature requests and bug reports, with varying degrees of quality, so then I just have yet another thing to stay on top of. I think Discussions were made to reduce noise in very busy repos, but I generally find something useful in the noise. It’s really just a way to ignore users. As a result, I always turn off Discussions and just let people file issues when they feel it’s appropriate.

I like macOS but we should be honest about some of its basic functionality being unintuitive. The “traffic lights” were pretty confusing to me for a while. Green button made the window grow but not fully maximize - I never understood the point of that (though, nowadays it goes fullscreen, which is great). Yellow minimizes, fine, whatever. Red appears to quit, but actually doesn’t, it merely closes the window, which is confusing for the simple case of only having one window. And the analogy of traffic lights doesn’t really work.

The classic one that everyone talks about is the weird way apps are installed by dragging an app into a folder, signified only by an arrow, with no explanation of what it’s doing or why. Also, that UI wouldn’t always show up, I believe because the app itself has to be coded to trigger it. So sometimes I would end up with an app running without having been installed. Therefor some of my apps wouldn’t show up in Launchpad, etc. Now that I understand the process, it’s pretty cool. And it’s simple, in a sense. But it fails any definition of intuitive.

The scroll direction of a mousewheel cannot be controlled independently from a trackpad. So one or the other is bound to feel wrong to most people.

There are simple things Apple could change to fix most of these, but I think it’s overlooked just because “that’s how it’s always been”.

Not yet, they’re trying to say that galvanization prevents rust and therefore it’s stainless. I don’t want to spend much time on this and they are probably betting on that.

In the future, I’m just not going to buy a product unless it specifies the alloy number, like 304 or 310 stainless. At least then there’s a lot less wiggle room for wordplay. It will unfortunately disqualify a lot of legitimate products that just don’t specify.

Are you aware that none of that is required when signing up for a site that supports passkeys?

I think there is some confusion here caused by sloppy use of terminology among FAANG and the standards groups. You’re right that, strictly speaking, Apple defined “passkeys” as synced credentials. And you’re also right to point out that, as a result, in order to consider them secure, you must trust Apple’s key storage and E2EE iCloud syncing, or the equivalent from other vendors. I wouldn’t blame you for being skeptical about synced credentials. The convenience may not be worth it for you.

However, crucially, synced credentials are just one type of FIDO2 credential. The other is a hardware-bound key from a “roaming” authenticator (aka a “security key”). These are never transmitted, never synced, and you can buy the security key hardware that generates and stores them from many different vendors, all of which are designed to be interoperable.

In other words, all passkeys are FIDO2, but not all FIDO2 are passkeys. Yet, when a website says it supports passkeys, it probably means it supports all FIDO2. And that’s because WebAuthn, the browser standard used to implement passkey registration and authentication on the web, supports all FIDO2 credentials, not just passkeys.

With WebAuthn (and most other systems), by default both platform authenticators (which would typically be synced, like you’re talking about, but not necessarily) and roaming authenticates (which would be typically be a USB security key, not synced) are allowed. I’ve occasionally stumbled upon sites that don’t allow platform authenticators, but I’ve never come across one that doesn’t allow roaming authenticators. It sounds like you want is the latter.

Apple could have avoided this mess by simply deciding that “passkeys” are the new name for “FIDO2 credentials” and then we could have synced passkeys and non-synced passkeys. But they apparently thought that was too confusing.

I’m convinced that a lot of the passkey hate ultimately stems from the inconsistent and confusing flows that websites have implemented in the name of backwards compatibility with passwords. I have made some apps where passkeys are the only way to log in and it is such a lovely experience. It can be as simple as a single log in button by itself, with no intermediate pages or other UX. There doesn’t even have to be a form to fill out at all.

The problem of losing physical access to your passkeys is only really a problem if the site chooses to be strict. There can easily be a “Send a magic link” button where you type in your email. It’s the equivalent of “forgot password”. For most systems, it’s already accepted that your security is only as good as your email provider’s is. Passkeys make it straightforward to have an email-less model, but you always could have done the same thing with passwords. No one forced you to implement “forgot password”, it was simply a practical approach that was worth the security tradeoff.

People seem to assume that we should leave that functionality behind in the transition to passkeys but I’m not so sure. It certainly seems more practical than trying to get users to maintain physical backup keys.

The concern about exporting passkeys is valid but you can share via AirDrop. Doesn’t that work on Android now?

Try to give passkeys a chance. I really think the growing pains are worth it.

He convinced me to get a Dyson vacuum. Worst expensive purchase of my life.

Nothing he said was wrong. Dyson’s performance is genuinely excellent. The problem is everything else.

It squeaks as I move it around while vacuuming due to flimsy rubber seals. It doesn’t have a retractable cord or any good place to put it. It has a clever feature where if the vacuum is fully upright, then the accessories are active, otherwise the main floor head is active - cool, except that the upright position never clicks well, I have to constantly fight it. I could go on and on…

None of these things show up on a spec sheet and I didn’t come across them in any reviews either. It looks cool and it cleans well, but every other aspect of it is junk. I’m never going to buy one again.

You should check out all of the voices available on macOS. They still have the original, robotic sounding MacinTalk voices from 1984, such as Fred. They’re fun to play with.

Personally, I think Majel Barrett is my favorite computer voice of all time.