I sometimes admin. But usually not.

  • 0 Posts
  • 45 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle





  • OP, this title is stupidly misleading and incorrect, you should change it immediately.

    The Taliban seized the DOMAIN, aka the ownership of the queer.af name that people could type into their browsers, and their system would resolve into an IP address.

    As the Taliban control Afghanistan, (see where the domain comes from), this was inevitable and the instance owners were already planning to retire the instance as they didn’t want to give money to the Taliban to keep it up.

    The INSTANCE, aka the physical server, was not in Afghanistan, and still has its IP address(es), and so has had absolutely nothing happen to it.





  • I googled Pyhäsalmi Mine gravitricity "2 MW" and EVERY article covering this has also cited 2 MW.

    Now, under Occam’s Razor, what’s more likely:

    1. Absolutely none of the article writers have any clue what the difference between a MW and a MWh is because none of them remember any physics
    2. Some of them could suspect that it’s wrong, but an authoritative source of the claim wrote/said 2 MW capacity when they meant “2 MW peak generation” or “2 MWh storage” (I’d presume Gravitricity, but I’m struggling to find such a source, myself)
    3. One writer miswrote/misquoted as per 2, and everyone is mindlessly recycling that original article’s contents with no attribution or care.

    I don’t know which one it is. But I’d generally lean against 1.




  • An API token is more secure than a password by virtue of it not needing to be typed in by a human. Phishing, writing down passwords, and the fact that API tokens can have restricted scopes all make them more secure.

    Expiration on its own doesn’t make it more secure, but it can if it’s in the context of loading the token onto a system that you might lose track of/not have access to in the future.

    Individual API tokens can also be revoked without revoking all of them, unlike a password where changing it means you have to re-login everywhere.

    And that’s just the tip of the iceberg. Lmk if you have questions, though.



  • Others beat me to the punch on saying this is just worse WebAuthN, but there are some specific flaws that boil down to saying that this whole thing is, at best, totally inconsiderate of real attack vectors such as phishing

    Online Login: On supported platforms, log in with your ‘Sign’ rather than your email address. The service checks for a corresponding email in their database that produces the same hash with the chosen algorithm/options. Services can eventually replace emails with ‘Signs’ for regular users.

    Enhanced Privacy: Limits the need to share email addresses, reducing spam and data breach risks.

    Huh? What does this even mean? How can you avoid sharing your email and replace it with a sign, if they need to check it against their database of… Emails?

    Real-Life Usage: In physical stores, use your QR-art ‘Sign’ when asked if you have an account/booked at table.

    Ah excellent. Someone can just look at a security camera or just snap a photo over your shoulder and steal your sign then. Because your proposal sure doesn’t note any way that these are 1-time use only. And if they were, this sounds like an awfully inconvenient way of receiving a temporary number (which sites usually only ever do as a cheap/bad 2FA method/password resets)

    Email Verification: Receive a unique link via email, confirming your email’s validity.

    Oh boy, better make sure to not get phished! Or that the link is 1 time use! Or that you aren’t being victimized by a MITM attack and getting it intercepted immediately!




  • Hey, I maintain a highly popular (if niche) FOSS library. Where the fuck is my big tech paycheck where they bribe me into integrating with their product?

    /s Silly take IMO, relies on cherry-picking popular FOSS projects where you can see “the influence” of big tech, AND then No True Scotsman your way into saying that they’re not allowed to participate in the development/influence of FOSS because… checks notes they’re the ones funding the project/putting money in front of otherwise unpaid volunteers?

    If you end up coming up with a better scheme for things that has the actual practical effect of compensating devs appropriately (yes, that means at current market rates or better) for their work, then please let us know so we can switch to doing that immediately. I will literally do anything you suggest if it would achieve that end.