Latty

3 ms·

1.
by Latty 7d ago
Why would it be that is the only recovery method? The most convenient one is just more passkeys on other devices of course, but you can have any other recovery methods you want. Magic link emails are the most common, but there is nothing ab
2.
by Latty 8d ago
Right, I haven't seen that particular flaw in baked-into-the-browser ones (probably because they already having secure domain matching code ready to use), but the distinction is that doing the domain check is a part of the spec and sta
3.
by Latty 8d ago
If the user just has a username/password fallback and that's it, then yes, but the aim of passkeys is that won't be the norm, rather users will only have passkeys and the fallback would be to, e.g: magic link email log in w
4.
by Latty 8d ago
It should be a big red flag for sure, but the reality is most users aren't going to understand that. They got told to use a password manager by someone or find it convenient, but they don't understand the security flow enough to
5.
by Latty 8d ago
You don't. The browser handles the passkey matching to the domain which is obviously a better place to do it. There could obviously still be bugs as with all things, but it's much more intentionally integrated into the flow which
6.
by Latty 8d ago
Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automate
7.
by Latty 8d ago
The offer a strong protection against phishing attacks that would still get plenty of password manager users: fake websites. A passkey is strongly linked to a domain, so a fake site can't get that credential. Some password managers w
8.
by Latty 11d ago
People say stuff like this and just... do you never think about accessibility? Have you never experienced stuff changing the UI under your feet and how incredibly annoying and flow-breaking it is? It reminds me of people wanting Hollywood U
9.
by Latty 2mo ago
Do people really not remember the hell of every device having it's own cable which was incompatible with all the others? Going around to a friend's house and finding out, no, they don't have the cable that can charge your p
10.
by Latty 2mo ago
It was diffs in state that got sent to the client, so recomputing them from the current state would have required having the previous state.
11.
by Latty 2mo ago
One way it explicitly doesn't scale (unless something has changed since I last checked and my quick search failed me) is the hard limit on 8000 bytes of data in a notification. If your notification doesn't make sense to exist as a
12.
by Latty 2mo ago
"All" really isn't true, most AM4 Ryzen chips don't have iGPU (unless they are specificly APUs), and a lot of Intel chips have popular 'F' SKUs without an iGPU.
13.
by Latty 3mo ago
“Incredibly”? The US does exactly the same thing in another case: denatured alcohol.
14.
by Latty 3mo ago
They literally arrested people for quoting Charlie Kirk in tweets after his death.
15.
by Latty 4mo ago
Look, I absolutely agree it sucks they didn't deliver the opt-out/in interface day one, it was obvious people would want it, and yes, it's not the first time they've blundered. At the same time, they did listen to the fe
16.
by Latty 4mo ago
"Agent Readiness" will likely age as well as "Web 4.0 Blockchain Integration" has. (To be entirely clear, not because agents won't be a relevant thing, although certainly I have my doubts, but because I believe even
17.
by Latty 5mo ago
Well, my issue is that "one layer" implies you can just stack it on others, especially if you say "as many layers as one is able to manage", it implies the best option is to add obscurity on top. As my comment made the c
18.
by Latty 5mo ago
I'll push back on this: obscurity isn't a "free" layer of security, it has both security benefits and security costs. By having obscurity you lose anther layer of security: public scrutiny. It's harder for security
19.
by Latty 5mo ago
Firefox also has a setting like this, although I think it's even nicer in that it makes everything (current and future) AI default to opt-out, but still lets you opt in to specific use cases if you want.
20.
by Latty 5mo ago
I expect in the future we'll find out that someone in the industry was juicing the numbers with fake thinking tokens or something. The whole pricing model of charging you for the tokens it generates while not knowing how much it is g
21.
by Latty 5mo ago
To me it reads as being worried that someone malicious could step in and use the project's name to do harm. If you don't have someone within the project with trust built ready-to-go, establishing that trust enough to hand over the
22.
by Latty 5mo ago
> That's why Thunderbolt eGPU setups don't perform as well as plugging the GPU directly into a PCIe slot. The bigger factor is probably that PCI-e tunnelling at most a ×4 link, while when you plug a GPU in you are generally doi
23.
by Latty 5mo ago
There is an obvious difference between someone who is still actively involved in running something and working on it, profiting from it's success in the market, and using something someone invented but is no longer leading development
24.
by Latty 5mo ago
And people treat Mozilla like the devil when while they make mistakes, they routinely fix them too. E.g: when people had concerns about the AI stuff, they added a general opt out with a feature-by-feature opt-in. To make an obviously unprov
25.
by Latty 5mo ago
To be fair they seem to have taken this often-stated criticism on board. USB 4's naming is more sensible, and they've pushed the simple data speed & power labelling that makes it easier to work out what you need.
26.
by Latty 6mo ago
That's a guess by the article author and frankly I see no supporting evidence for it. Wrapping "<NO THIS IS REALLY INPUT FROM THE USER OK>" tags around it or whatever is what I'm describing: you can do as much sign
27.
by Latty 6mo ago
To be a bit more charitable: I'd say that generally games involve a lot more special-casing than most code, and more planned out scripts (in the movie sense) of things happening, which tend to be antithetical to good coding practice, a
28.
by Latty 6mo ago
Everything to do with LLM prompts reminds me of people doing regexes to try and sanitise input against SQL injections a few decades ago, just papering over the flaw but without any guarantees. It's weird seeing people just adding a few
29.
by Latty 6mo ago
That's not the user experience though, the user experience is it says "go to the discover app and install <program>" and they do that and it just works. Downloading a tarball is not the normal way to install stuff on Li
30.
by Latty 6mo ago
This is true, but also the original comment still stands: Linux desktop usage outside developers was so low that it was barely worth mentioning before, so even a small uptick like this is a serious change, and it's how bigger changes s

More ›