I try to respond to every genuine engagement. I block trolls, contrarians, and provocateurs because life is too short.

  • 0 Posts
  • 71 Comments
Joined 2 years ago
cake
Cake day: January 29th, 2025

help-circle








  • Do it. You should go all-in on AI today then. Buy all the OpenAI and Anthropic-linked stock you can. Right now. That would be the inverse Zitron move.

    But you won’t, will you - because the thing that Ed has repeatedly said will occur soon, is occurring now: the bubble is popping. Google lost 14% of its value in 1 day, $500 bil. The worst day they’ve ever had, last week. ~340 billion has been wiped from the Chinese LLM market in the last couple of months - it would be a lot more, but China’s authorities halted further trades. OpenAI’s latest funding round got half the funds they were hoping for. Major investing firms have labelled Anthropic’s pending IPO ‘junk grade’.

    The house of cards is toppling, and this seems like the dumbest time one could choose to say ‘wow, Ed is wrong so often’.









  • I think it’s referring to Linus using AI to develop a python GUI in January for a personal pet project (AudioNoise).

    It was the beginning of this cognitive outsourcing that’s led to him telling people with entirely legitimate concerns (e.g. that LLM output can’t be copyrighted, so it can’t be licensed as GPLv2) that he’d ignore them all and to “fork it or walk away”, to people who have developed the kernel for many years of their lif… To now - hiding LLM commits to obfuscate kernel commit info.

    I respect and appreciate Linus, but the recent developments highlight a larger (and old) problem of Linux - a single point of failure in Linus and the BDFL attitude. He’ll eventually leave the kernel in some way, and while there are drafts and proposals for a succession plan - none have been seriously considered to the point of any action by Linus. He remains the kernel BDFL, and Linux kernel development remains neither a meritocracy nor a democracy.


  • Maybe? I’d say that TOTP is probably more ‘phishable’ than passkeys - but I doubt there are actual stats on it.

    If an end-user is the kind of person that’s fooled by a fake bank website that is on the wrong domain with a sketchy certificate - and approve 2FA requests without much thought - then it is probably likely they’d be fooled by a fake bank website that says, “per our recent updates, [yesterday’s date] is the last date to switch to using an updated web browser. Our bank website is no longer compatible with this web browser, please open one of these browsers [list of any major browser useragent not identified as the current browser] and attempt login again”.

    That could either completely bypass their pre-configured bank passkey with legacy login to the fake bank, or the attackers could just pushing them to configure a new passkey to the fake bank on the new browser (the attackers wouls set up a real passkey to the real bank in parallel, using the supplied credentials in the background).

    There is certainly proof of concept and examples in the wild of significant cases of people being tricked into approving additional devices with passkeys.


  • I swear most people have forgotten what TOTP was used for in the first place - two-factor auth to protect people re-using passwords getting hit by password breaches on other services, people using low complexity passwords, and to protect people’s breeched devices (e.g. computers getting viruses or malware or drive-by credential nabbers that give the attacker access to your credentials in some way). In short, to solve some poor security practices. 2FA via TOPT still solves all of those problems.

    Passkeys fix a different problem. On their own as a technology they essentially just increase the quality of a password, while tying that password to a single device. So they fix the problems of re-used passwords, and unsophisticated passwords. But with many implementations they fall back to being single-factor auth - if a user has access to your device, they can use the passkey (with exceptions such as passkeys stored on a physical second-factor like a Yubikey that requires physical approval to use).

    TOTP meanwhile requires two devices to be accessed by design.

    As myself and most tech-aware users already use unique, sophisticated passwords - they don’t solve a problem for us.

    However, if businesses allow passkeys as a simple password alternative, while still allowing TOTP as a second factor, I’d be happy to do so for critical access items (mostly banking). However, I’m not aware of this being the case for any common implementations in major businesses.

    Passkeys are just ‘Yubikey without the Yubikey or physical approval’ - pointless to me. False sense of security even.