Badabinski

Right, but I can’t require a second factor on a different device that operates outside of my primary device’s trust store. I’m sure there is some way to make my desktop hit my phone up directly and ask for fingerprint auth before unlocking the local keystore, but that still depends on the security of my device and my trust store. I don’t want the second factor to be totally locked to the device I’m running on. I want the server to say, “oh, cool, here’s this passkey. It looks good, but we also need a TOTP from you before you can log in,” or “loving the passkey, but I also need you to respond to the push notification we just sent to a different device and prove your identity biometrically over there.” I don’t want my second factor to be on the same device as my primary factor. I don’t know why a passkey (potentially protected by local biometric auth) + a separate server-required second factor (TOTP or push notification to a different device or something) isn’t an option.

EDIT: I could make it so a fingerprint would decrypt my SSH key rather than what I have now (i.e. a password). That would effectively be the same number of factors as you’re describing for a passkey, and it would not be good enough for my organization’s security model, nor would it be good enough for me.

I just don’t get why I can’t use something like TOTP from my phone or a key fob when logging in with a passkey from my desktop. Why does my second factor have to be an on-device biometrically protected keystore? The sites I’m thinking of currently support TOTP when using passwords, so why can’t they support the same thing when using passkeys? I don’t want to place all my trust in the security of my keystore. I like that I have to unlock my phone to get a TOTP. Someone would have to compromise my local keystore and my phone, which makes it a better second factor in my opinion.

EDIT: like, at work, I ssh to servers all over the damn place using an ssh key. I have to get to those servers through a jump box that requires me to unlock my phone and provide a biometric second factor before it will allow me through. That’s asymmetric cryptography + a second factor of authentication that’s still effective even if someone has compromised my machine and has direct access to my private key. That’s what I want from passkeys.

This is a bad take. Several cities in my state banded together to create a municipal fiber network called UTOPIA. The fiber is owned by the cities that bought in and is used by several different ISPs. The ISPs pay UTOPIA for access, and then they have to compete with each other for subscribers based on performance, features, and cost. Like, there’s genuine market competition for internet! If the state owns the infrastructure and then forces the playing field to be level, then everyone benefits. People in the cities with UTOPIA got fast fiber internet waaay faster than anyone else, they have a plethora of choices (want a static IP and a business plan in your residence? There’s an ISP that sells that!) at great prices, ISPs get access to subscribers without having to maintain fiber, and the cities who bought in get to make money from this and attract residents and businesses who benefit from the service.

My city didn’t buy in. Google Fiber eventually came to town so I was able to kick Comcast out, but I am uneasy about what’ll happen if Google decides to drop their ISP business. If I was in a city with UTOPIA, it would just be one ISP folding and I’d be able to pick a new one and switch over right away.

EDIT: cool, Cory Doctorow wrote a blag post about it: https://doctorow.medium.com/https-pluralistic-net-2024-05-16-symmetrical-10gb-for-119-utopia-347e64869977
UTOPIA users have access to 18 different ISPs. I feel like that speaks for itself right there. This is the future we all should have had.

It already is. My company runs hundreds (possibly thousands) of ARM64-based instances right now. It’s done great things for our cloud spend. We still have more x86 stuff than ARM because some applications just don’t perform as well on ARM, but I can imagine that ratio will change as software gets more optimized (specifically the JDK, golang’s compiler, and GCC/LLVM) and Ampere releases new systems with better single thread perf.

EDIT: Ampere, not Alterra. God damn tech company names.

You can run Asahi Linux on M1 MacBooks right now. If you didn’t see the news, they’ve even been able to run some relatively modern AAA games with decent enough frame rates. Granted that’s only the M1 macs, but there’s at least one relatively modern ARM laptop that you can run Linux on.

I’ll totally concede that the new Snapdragon laptops aren’t running Linux yet. It seems like Qualcomm is taking Linux support seriously, but I’m a bit skeptical as someone who has been absolutely fucked by a shitty Qualcomm kernel module.

I just wish that companies enabling passkeys would still allow password+MFA. There are several sites that, when you enable passkeys, lock you out of MFA for devices that lack a biometric second factor of authentication. I’d love to use passkeys + biometrics otherwise, since I’ve often felt that the auth problem would be best solved with asymmetric cryptography.

EDIT: I meant to say “would still allow passkeys+MFA.” hooray for sleep deprivation lol.

https://sourceforge.net/p/flightgear/flightgear/ci/next/tree/

This random git repo I picked from their source forge page seems to have some pretty recent commits. I’m guessing they just have a slow release cycle.

Yeah, the time drift between the earth and moon is small, but it’ll noticable for latency-sensitive software.

God, I’d hate to be the dev that has to deal with relativistic time zone conversions. What a fucking nightmare that’d be…

Playing it blind is absolutely like that. In retrospect, I’m surprised that I stuck with it. I usually struggle with hard games! The atmosphere and mechanics were enough to keep me playing tho. Totally understand though, it’s not everything for everyone.

Starship landing was a success too! They landed right on target this time. There was still a bit of burn-through at one of the aft fins (much less than before), and it exploded a little bit after it landed. Hopefully they’ll be able to land Starship on the ground next!

Holy shit, really‽ I had no idea.

Smart Audiobook Player is different from Simple Audiobook Player. I actually didn’t know about Smart ABP, it looks pretty nice!

I agree, I’d prefer a FOSS option that’s self-contained. The only server I need is one that I can rsync books down from.

I haven’t seen it mentioned here, so I’ll rep for Noita. It’s an amazing rogue-like with great atmosphere and a really compelling world to explore.

There’s a chemistry/alchemy system in the game that is really detailed and fun to explore. The game’s tagline is “every pixel simulated,” and it’s not an exaggeration. Noita is like those falling sand games that were popular in the early 2000s, where each particle of sand could interact with other particles. Imagine that, but you’re a badass witch flying through the world and blasting motherfuckers who try to get in your way. Your wands can set things on fire or freeze them or melt them with acid or blow them up or other crazy shit.

The wand mechanics are incredibly deep. Like, it’s not “turing complete” levels of deep, but the rules for spells interact in incredibly interesting and exploitable ways. The feeling you get when you discover a powerful combo of spells is incredible.

The devs also have a cool policy of turning bugs into gameplay mechanics. I really can’t say much about this without spoiling things, so this one is hard to talk about. Basically, if someone finds an exploit, they oftentimes won’t “fix” it. Instead, they’ll take it and tweak it to add consequences for using the exploit, or they’ll balance it a bit to make it harder/remove a bit of the benefit. It’s a really cool approach and has lead to a great relationship between the devs and the community. They don’t take our toys away, they just make them work better in the world.

I played the game completely blind until I got my first win (it took about 80 hours of playtime), and I’d highly recommend that approach for folks who are willing to tolerate failure and who like to experiment. If it’s too frustrating then that’s okay, there are a lot of guides out there to help out new players without giving up too much. Many people describe your first win as you beating the tutorial, and there’s some truth to that.

It can be gruellingly difficult at times, but it’s just so damn good, and there’s so damn much of it. I have around 600 hours in in that game which is twice as much as any other game I’ve played.

I think they’re all top-level responses too. I took a random sampling of their comments, and they never respond to anyone else’s comment. That smells like someone being lazy and not bothering to iterate through comments when writing their dumb AI commenting script.

Like, just, what the fuck is this shit? There’s one comment from 8 months ago that looks real. Everything else is from the past week and reads like LLM drivel. Why would you bother? Is it just someone who is bored and wanted to see how long they could convince people?

I love Simple Audiobook Player+. The UI is super minimal (and really maxes out the whole OLED black thing if you choose it) without compromising on features that are kind of essential for audiobooks (e.g. delayed pause/sleep timers, speed settings, volume boosting, an EQ). My favorite thing is the “undo seek” button. I’m an oaf who is constantly inputting accidental touches. When I was using Audible, I’d have to manually find where I was after accidentally hitting the next chapter button or moving the dot on the progress bar. SABP lets me just undo that shit.

It hasn’t been updated in a while, but it doesn’t need updating when it does its job so well. There are no ads, no marketing notifications, just books. It’s like a program from coreutils in app form. It might be a bit ugly or outdated looking, but I’m about that.

Thank god for projects like Valetudo thar let you break your stuff away from the cloud.

Semi-related story time. I bought a Midea Cube dehumidifier for my laundry room. My dryer has been broken for years, and I’ve found that air drying clothes makes them last a lot longer. It’s hard to air dry inside, hence the dehumidifier. My plan was to control the dehu automagically with Home Assistant along with some fans, so people could just click a button to turn all the shit on to dry their clothes.

After buying it, I realized that the dehumidifier could only be controlled via the cloud, and the cloud control was unreliable as fuck. With the exception of tech people, nobody is willing to deal with my flaky bullshit. If the button doesn’t work consistently, my partner, her other partner, and my FIL aren’t going to bother. Luckily, a very industrious person made this thing that let me rip out the hardware responsible for cloud connectivity and replace it with a cheap microcontroller. Now, my dehumidifier talks to my Home Assistant server directly via MQTT and it just fucking works.

Give me local-only control or fuck off, I’ll take control myself. It’s not much to demand, and shit like what this article describes absolutely deepens my conviction around local-only control.

Yeah, it’s really not too bad. It’s mostly boring. I brought headphones to my last root canal because I don’t like the sound the tools make (there’s some bone conduction going on, so the headphones let me drown that out) and that made the whole experience much nicer for me. I’m particularly sensitive to sounds, so sound has always been the worst part of any dental work for me.

I liked how each of the sections ended with a different game that she’s gotten running so far. It makes the article feel like a progressively bigger flex, which, of course, it is. Awesome to see this work progressing!

Fuckers. I don’t know why you’d want to hack the IA, but they’re dicks for doing so. I’m gonna throw some of my spondulix to the IA, and I’d encourage others to do so.

I love how aggressive they are in their FAQs for things like this.