throwaway41597

Not that simple. When carbon in the soil rises beyond a certain percentage (a tree falls) it'll convert back to CO2 because of the bugs eating it. But if the percentage starts at zero (in a desert) and an ecosystem settles there, the percentage will rise and stay above zero for as long as the ecosystem survives. Basically the plants generate matter as fast as wildlife eats it.

This sequestration can be long term if things go well or it can be short term if plants die in large numbers (because of climate change, diseases...).

Trees excel at harvesting water. When you water a tree, there is evaporative cooling like an artificial cooler but during the night, the dew falls back on the leaves and the ground where some of it finds its way back to the trees (possibly via an invertebrate first). Also the reflectiveness of leaves helps. Then there's the soil where layers of dead leaves, wood and others accumulate, sequester CO2 and create a sponge. Finally, by virtue of making the region cooler, rain is more likely to fall. Humans can probably engineer something better but the bar is high.

You're not describing how a tiling WM fails to satisfy your needs. My guess is you're unhappy with toolbars being repeated in each tile, is that it? If so, I believe Suckless's striped-down browser is the closest, together with a tiling WM.

If code editors are indicative, yes some power users tend to like a tiling window manager bundled in the app. So you may be right but I think it's out of scope for Firefox which targets the masses and it's definitely off-topic here.

I'm not sure how what you describe is not what a tiling WM offers. Except for the "closing main window" thing but can't you just cancel closing with the history menu?

I'm very curious as well because my very limited understanding tells me the answer is nothing. The relay hides your identity. Your phone checks the attestations so it won't send your data to servers not running the published software which ensures encryption keys are ephemeral. Once your session is done, the keys are deleted.

Law enforcement would need to seize the right server among millions while it's processing your request and perform an attack on it to get the keys before they're gone.

My next question is what happens if/when the attestation keys are stolen.

The goal is money and control. They enact a partial "solution" so later on they'll say they need more access to private data because of the loopholes. Meanwhile the industry of surveillance and compliance grows providing more paper pushing jobs to the establishment. Power-tripping politicians also get the ability to spy on opponents and basically anyone they please.

The same argument of diminishing returns, that quality of life doesn't improve much when going from 130k€ to 1M€ can be applied to capital controls. Is this 10k€ limit really what is needed to save the welfare state? Were the previous controls not enough?

Or is it that the welfare state is collapsing on its own and grasping at straws?

Depending on the scope, it's not always possible to self-fund while starting a project.

Very sorry to hear that, end of life is hard for many. Thank you for your post and the discussion it brought.

Considering how vast, obscure and absurd the law is, I think it should. As a matter of fact, it often is.

Chrome allows you to export saved password in CSV (chrome://settings/passwords) So I'd say it is a regression in this regard. You won't be able to switch to an other browser easily, you'll have to go to each websites and change/add authentication methods as far as I know.

> No, because PBKDFs are not a good mechanism for creating encryption keys

I'm curious about what you mean by this. Isn't it in part what PBKDFs are designed for?

The lock-in is very real and relevant.

Websites already have a hard time to get users to sign up, so requiring them to enroll backup authenticators (which they won't have) is not going to work. Printing or writing down backup codes is even worse from a UX point of view.

IIRC the spec has a flag to hint that the passkey is backed up (in iCloud or your Google account) so the relying party (website) knows whether backups are mandatory but that means the secret doesn't stay on your device and goes to the mothership. Then I don't see why the spec wouldn't standardize the transfer of secrets from one company to the other.

I think he means that you don't point your domain's public DNS records straight to your home IP (where your NAS sits), but rather via Cloudflare.

If so, doesn't Cloudflare do HTTPS termination? Meaning that all your photos would be visible to them during transit.

Thanks for your reply. I think the issue you describe is more due to the website. A website that accepts Passkeys should provide a way to enroll a competitor. In this case it could be as simple as copying a code in one browser and pasting in the other. This isn't too bad if you consider that typing a user+password pair is also annoying though more familiar. Of course, it gets near impossible if the device is dead and the user wants to switch brands without any backup. But again, websites enrolling only one authenticator and no alternative are somewhat negligent.

I think people who evangelize Webauthn need to carefully convey the risks and remind everyone that end users need backups (multiple authenticators, backup codes...). Hopefully, down the road, it will force interoperability between big manufacturers so one authenticator can authorize another for all websites in one go (this probably requires websites to have a standard way to enroll new authenticators).

> My separate observation about a lack of support for hardware keys to be "paired" to support an off-site backup

This is worrying me more. Interoperability between tech giants is bad but the sovereign solution may never get there.