varenc

Honestly, that's exactly how I want it to work. The people doing it en-masse are the ones Google really wants to stop. It would be sad if yt-dlp broke for casual users just because Google wants to stop a small subset of people downloading terabytes of video training data. This feels like the perfect arrangement and yt-dlp can keep working for 99% of users.

It's tethered to the USD. It seems expected that the government in charge of USD is doing the most blacklisting.

People carrying planks of wood on the sidewalk is obvious to everyone and clear inconvenience. What tech companies do in software is not, and has no physical immediately tangible effect on the world. These things should be regulated, but they're so opaque and disconnected from the eventual negative externalities that it's hard to get legislators to see it.

I don't see this as irresponsible disclosure. They show that the vulns exist, but don't give any other details (unlike previous Calif releases). Not even a hint at what the exploit chain is like other than that it starts with a PDF, which is a surprise to no one.

They're of course also doing it for internet kudos, but attracting attention like this will help encourage people to update. Thanks to this article, I'm going to apply the next iOS security update ASAP, and tell everyone I know to do this the same. (hopefully it comes out soon)

I do wish they clearly stated the vulns have had been reported to Apple and when.

hacks like these, where you go from a PDF to full persistence, require a chain of exploits. Pegasus, the iOS malware that made the news awhile ago, used a chain of 3 exploits like this:

   [ Stage 1: Safari/WebKit ] ──> [ Stage 2: KASLR Bypass ] ──> [ Stage 3: Kernel Execution ]
     (Memory Corruption/RCE)        (Kernel Info Leak)            (UAF Privilege Escalation)

If you lose your domain, you have bigger problems than just passkeys. If you just used passwords, users would still have to somehow locate your new site and trust it with the password previously associated with your old site. Password managers won't input passwords from one domain onto a new domain.

As someone else said, you'd have to do an email blast and hope users trust the email blast as authentic to trust your new domain, and just someone phishing.

Loss of a domain is so catastrophic for trust that passkeys don't make it much worse.

> Why are passkeys better?

Passkeys provide perfect protection from phishing attacks, since it's impossible to send a passkey to the wrong domain. That's a huge improvement over TOTP.

Re: it being confusing where they're stored, I agree. The solution is to make sure you store your passkeys in your cross-platform password manager. The experience can be confusing though. In Chrome I've found that by default when creating a new Passkey Chrome offers to store it first. But if I click cancel, I'm then given the option to store it in 1Password where I want it.

News site probably want to be accessible to all search engine crawlers, not just Google, and I bet some of them don't have the reverse DNS verification method.

But also, tons of news sites also only implement the paywall in client-side JS! This is so obviously easy to bypass it seems intentional, and they just don't care about the 'hackers'. Or perhaps they've know that people that are going to use tricks to access an article are very unlikely to pay for a subscription anyway.

(I wish I could just pay $1 on demand and read a paywalled article. I'd do it all the time, but I'm quite reluctant to sign up for any forever recurring subscriptions)

> ... it chains several bypass methods per request

I'm curious what are the techniques? I'm familiar with spoofing yourself as a Googlebot, or extracting the content directly when paywall enforcement is done in client-side JS only. But surely you need more tricks than that to get around WSJ or NYTimes. Also, ironically, I assume archive.is's CAPTCHA would need bypassing to fall back to that. (but volume might be low enough you can do it with a few cookies you've established trust on)

> it doesn't have the recaptcha

Agreed that makes it quite nice! Though I wonder how long that will last, since I imagine archive.today is dealing with some problems that necessitated it.

The whole John Donne meditation the title is referencing:

    No man is an island,
    Entire of itself;
    Every man is a piece of the continent,
    A part of the main.
    
    If a clod be washed away by the sea,
    Europe is the less,
    As well as if a promontory were:
    As well as if a manor of thy friend's
    Or of thine own were.
    
    Any man's death diminishes me,
    Because I am involved in mankind.
    And therefore never send to know for whom the bell tolls;
    It tolls for thee

(had to memorize it in High School, and its one of my favorites. It was written over 400 years ago and has aged quite well.)

decompilation doesn't trigger any safeguard refusals? I would have assumed it would but glad it doesn't. Very cool and would also love to hear more.