growse

12 ms·

211.
by growse 2y ago
Totally naive question: is this better than you get than simply compressing? It's not 100% clear to me why explicit deduping blocks would give you any significant benefit over a properly chosen compression algorithm.
212.
by growse 2y ago
Quite a few billion people are not fine with it, and I'm not seeing any serious argument designed to convince them why they should be. No-one cares if you set your watch to UTC regardless of your latlng. Meanwhile, the rest of us wil
213.
by growse 2y ago
It's simply pointing out that "I take full responsibility" is empty, meaningless rhetoric and serves no real purpose. It's often offensively insincere.
214.
by growse 2y ago
I think you've got who's serving whom the wrong way round.
215.
by growse 2y ago
The thing that super accurate timestamps buys you is common agreement across your infrastructure as to what the time is. This basically makes distributed systems work faster/better/whatever. The relation between that time and wh
216.
by growse 2y ago
This comment shows up like clockwork. How does a device with a 32-bit-sized addressing scheme construct an IP packet to a device with an address in a 128-bit-sized addressing scheme?
217.
by growse 2y ago
You don't have root. Google does. I'm not saying that's a good thing, but it's not exactly a secret when you bought it.
218.
by growse 2y ago
SAF was first released as part of Android 4.4, back in 2013.
219.
by growse 2y ago
These people are neither competent nor serious. In the real world, people who design and operate large networks are the very same people who staffed the working groups who designed IPv6. It's their design.
220.
by growse 2y ago
> I also find it really weird as the killer (only?) app for IPv6 is that home hobbyists can run servers with low overhead! Well, the non-trivial percentage of large orgs that have literally run out of RFC 1918 space would disagree. But
221.
by growse 2y ago
I'm aware there's a middle box. My point is that the middle box is a compatibility layer which, by definition, has the effect of enabling compatibility (at least in one direction). The usual "they should have designed it to b
222.
by growse 2y ago
Why? I want it to have access to the folders I want it to sync, not everything on my device . Seems like a perfect fit for SAF.
223.
by growse 2y ago
I can route to v4 endpoints on my v6-only network just fine. Shrugs
224.
by growse 2y ago
I'm not sure I've ever heard this view expressed by serious, competent network engineers. I have heard it a lot from the home hobbyist though, but I'm not sure how much that demographic matters in the grand scheme of things
225.
by growse 2y ago
Browsers should follow the spec. Whether or not attestation data is passed onto the browser is a decision the passkey provider can make.
226.
by growse 2y ago
The regulatory universe that banks operate in means that they're not like other companies. They don't share the same overall incentives, and aren't a useful point of comparison.
227.
by growse 2y ago
It's up to the provider as to whether they provide or not. I don't think there's a "default"? I seem to remember that apple specifically don't provide attestation details on their implementation.
228.
by growse 2y ago
The attestation is part of the webauthn spec, and it's up to the relying party to decide whether or not to use it. The whole reason it's there is to give some contexts the ability to narrow their users down to specific webauthn st
229.
by growse 2y ago
> Sorry to be on blast here but every time passkeys come up the "use multiple keys" gets said & it's a joke. There needs to be a flow where I can create a passkey & have it replicate to a bunch of devices automatic
230.
by growse 2y ago
If you want a Webauthn credential that you can "copy", don't use a Yubikey. Use something like KeepassXC, BitWarden etc. instead.
231.
by growse 2y ago
Passkeys are just resident webauthn tokens with a fancy name. Where's the lockin?
232.
by growse 2y ago
> This is not a security issue for anyone, least of all people using browsers. I disagree. The smooth running and ease of automation of TLS certs benefits the entire ecosystem, including the end-users. Remember when the only sites that h
233.
by growse 2y ago
The CAB (who are setting the TLS cert issuance rules) are optimising for their users' security. Their users are "people using browsers", not "people asking for cert signatures".
234.
by growse 2y ago
It's got nothing to do with what committee decides what the expiry is and how they then enforce it. The thing that certs and passports have in common is unrelated to whether the issuer is a governmental body or not. They're both c
235.
by growse 2y ago
What do you think passports and signed TLS certs have in common? (Hint, it's nothing to do with "the government").
236.
by growse 2y ago
Nothing stopping you running your own CA and issuing your own certs. Your actual problem is that the browser vendors (who decide which certs should live in the root store) have certain criteria which CAs need to meet in order to be trusted.
237.
by growse 2y ago
As far as I understand it, two problems: * Certs come with secrets. Long-lived secrets are riskier than short-lived ones because of window of opportunity if they're compromised in an undetected way. * Less frequent cert rotations mean
238.
by growse 2y ago
Ah, yes, the evergreen comment that suggests it would be better if people living far from the meridian experience the joy of Wednesday turning into Thursday at some point whilst they're awake.
239.
by growse 2y ago
I get what you're saying, it's about incentives and the slopey-shoulderyness that characterises the "someone else's problem" culture. My point is that this is a bad culture for the company. There's no point p
240.
by growse 2y ago
If I was paying a large amount of money for a service that was then down, and then the vendor just shrugged with "s3 is down, nothing I can do", I'd be re-tendering that very day.

More ›