growse

6 ms·

61.
by growse 1y ago
//nolint
62.
by growse 1y ago
> if it would never work, why not drop support? Because passkeys are designed to replace passwords across multiple different service contexts, that have different requirements. Just because there's no reason to use it for one use ca
63.
by growse 1y ago
> If you make something possible, it will be used. Sure, but that's not without tradeoffs. I come back to: > Any service requiring attestation for passkeys will effectively lock out every iPhone user - not going to happen.
64.
by growse 1y ago
I missed a word out from my question. Let me try again. What makes you think that the Webauthn standards are _only_ "targeted at running services for the general public"?
65.
by growse 1y ago
What makes you think that the Webauthn standards are "targeted at running services for the general public"? > It seems like the requirements already diverged. No, the requirements are _contextual_. This isn't a new idea.
66.
by growse 1y ago
Not all people who want to replace passwords are running services available to the general public. There are a bunch of service provider contexts where credential storage attestation is a really useful (and sometimes legally required!) feat
67.
by growse 1y ago
I agree that account recovery isn't the best. But just because that sucks doesn't mean there's zero value in improving credentials.
68.
by growse 1y ago
Literally no idea. My point was that freedom is not an absolute, it's balanced against other freedoms. It's hard to tell whether you agree with that or not.
69.
by growse 1y ago
Do you think someone running a service that's under constant denial-of-service attacks would be sympathetic to the argument that "What people do on their own computer is none of the service's business". Pretty much every
70.
by growse 1y ago
I don't know what "scare quotes" are. They're just regular quotation marks, because I'm quoting.
71.
by growse 1y ago
It is if it puts the service at risk.
72.
by growse 1y ago
No, they're just resident webauthn credentials which use asymmetric crypto.
73.
by growse 1y ago
> very obviously once Passkeys are everywhere it'll become "we're requiring attestation from approved device bootloaders/enclaves" This is far from very obvious, especially given that Apple have gone out of their
74.
by growse 1y ago
There's a tension here between "user freedom" and a service wanting to make sure that credentials that it trusts to grant access to stuff aren't just being yolo'd around into textfiles on people's dropboxes. Pe
75.
by growse 1y ago
Without a lock file your transitive dependencies are.... by definition not centralised? Or have I misunderstood?
76.
by growse 1y ago
> but I'm really good at my job How good you think you are at your job is pretty meaningless if some manager above you wants to weaponise the company's perf policy against you.
77.
by growse 1y ago
> One should be able to map, protect, etc memory ranges down to byte granularity - which is the granularity of everything else in computers. But you can do this, you simply have to pay the cost of using PAGE_SIZE of memory per byte you w
78.
by growse 1y ago
I agree. But not enough people are costing out the 'do nothing' option (it's not zero!).
79.
by growse 1y ago
One of the biggest fallacies I see in this space is people looking at an observability standard like otel and thinking "I must enable all of that". You really don't have to. Throw away traces. Throw away logs. Sample those me
80.
by growse 1y ago
Everyone knows that a donut has two sides. Inside, and outside.
81.
by growse 1y ago
Does copyright law apply differently to humans Vs organisations? > without any compensation, Didn't Anthropic buy the books?
82.
by growse 1y ago
> Worse, they’re using it for massive commercial gain, without paying a dime upstream to the supply chain that made it possible. If there is any purpose of copyright at all, it’s to prevent making money from someone’s else’s intellectual
83.
by growse 1y ago
> So is almost every other standard, but until something better comes along, DNSSEC is what we have. I must have missed the last 40 years of the internet where DNS without DNSSEC has worked (and continues to work) just fine.
84.
by growse 1y ago
This feels like a classic example of "actions at the sharp end resolve all ambiguity" from Richard Cook's 1998 paper on complex systems.
85.
by growse 1y ago
Everyone seems to miss the "single unbreakable pki" aspect that necessarily comes along with the design. :shrug:
86.
by growse 1y ago
I've worked for these orgs on this exact problem. It's the latter.
87.
by growse 1y ago
Apparently the way to do sane risk management is just "don't be an idiot"?
88.
by growse 1y ago
We could live in a world where they don't exist and the vast majority of major financial institutions still wouldn't implement DNSSEC. https://dnsinstitute.com/research/2020/banks-dnssec-202010.h... Yo
89.
by growse 1y ago
Isn't the vast majority of TLS connections using SNI today?
90.
by growse 1y ago
Slack's house literally did burn down for 24 hours because of DNSSEC back into 2021. When you frame the risk as "marginal benefit against one specific threat" Vs "removes us from the internet for 24 hours", the big

More ›