#FIDO2/#WebAuthn: Open, transparent standard that actually addresses security problems and brings web authentication to the level of SSH (where we've accepted keys including host keys as like, bare minimum).

FUDders: Take some obscure, optional footnote feature (remote attestation) that's irrelevant to personal use and make a big deal out of it, claiming that somehow passwords + TOTP is somehow as good.

I still remember when it was sooooo 1337 to have a YubiKey despite a) zero adoption for FIDO2, b) terrible loss/backup situation and c) only minimal security improvements to having a physical second device¹.

Now that FIDO2 has somehow big backing, we solve loss/backup through optional(!) syncing and make having a physical key optional too... now it's suddenly evil tech. Ugh, pseudo-security hipsters.

¹ in some cases it's arguably even worse since you'll likely notice your phone missing earlier than your YubiKey.

#Passkeys

Drawing the Line

Bonus speedpaint: https://www.peppercarrot.com/en/miniFantasyTheater/074.html#bonus

#webcomic #krita #miniFantasyTheater

Reminder: forced password rotation is a bad thing and must be avoided.

Because all the characters will slide towards one side, the resulting distribution will not be random, but very skewed.

People are freaking out about agentic hacking, but let me remind you that a solution, first articulated in 2015, is well within reach

@sashag@anarres.family das heißt Bonnjour

Jetzt rafft euch da endlich in #Berlin! Scheisse, ey, die #Grünen sind sowas von gestorben für mich, wenn sie das jetzt verbocken.

(Zum "Glück" muss ich in Spahns Wahlkreis wählen, da wars rückblickend eh egal.)

https://taz.de/Sondierungsstopp-in-Berlin/!6221494/

Restrooms at a new local cocktail bar.

#restrooms #bathrooms #cocktailbars #gender #DnD #funny

Von being awake zu being a woke geht der weg durch ein ei

Solche Durchsuchungen wie bei der Zeit sind übrigens keine so krasse Ausnahme wie Anne Kunze und die Zeit es darstellen. Zuletzt gab es zB Durchsuchungen bei @RDL, das Smartphone von Hendrik Torner wurde beschlagnahmt und ausgewertet, bei Lars Winkelsdorf gab es eine Hausdurchsuchung und auch bei Leon Enrique Montero.
Die meisten werden übrigens nicht vor die Wahl gestellt ob sie die Daten herausgeben wollen um eine Durchsuchung abzuwenden. Das wird meist nur bürgerlichen Medien angeboten.

The Linux kernel is going to remove the requirement to disclose that "AI" was used for a contribution. Apparently, this was decided at the Linux Maintainers Summit, away from the LKML. No open discussion.

https://lore.kernel.org/lkml/20261009083137.3-1-sashal@kernel.org/

What a clown show.

Ist die noch regierungsfähig? CDU mit Verbindungen zur Remmo-Bande: https://www.nd-aktuell.de/artikel/1203136.landespolitik-berlin-auch-die-cdu-haelt-kontakte-zum-clan-milieu.html

#berlin #cdu #remmo

rain in berlin at night is just <3

Terrible idea @fnci and I came up with: Alternative C3 closing event, with "statistics" of:

* how many lice outbreaks
* how many liters of lube used
* how many people came (of which: at FLINTA* cruising)
* how many warnings issued by PL
* ...

One for the Linux nerds out there:

🎶
Ra-Ra-Rasputin,
ls /usr/local/bin
🎶

@remmy @0xabad1dea Piper is Google's internal clone/rewrite of Perforce using its own infrastructure. They have a single monorepo called google3 that stores almost all of the source code for the entire company's products. I don't know how many engineers that is nowadays, but certainly O(10,000s) all using one repo. To make any change you create a "changelist", kind of like a PR in Git terms. Changelists are assigned as a monotonically increasing quantity. So when the company would get close to some significant epoch like "changelist #100000000" a bunch of engineers would all run shell scripts creating hundreds of new changelists to get the nerd cred of being the one to create that one special changelist number.

Das ist nicht wirklich ein Scherz - nur halb. 🤨

the same result i had a half a year ago just appeared on arxiv and its hard not to feel salty at coauthors who dragged the writing process slower than needed and fed the result into online llms for proofreading

yeah everyone did the local optimal thing at every point and being scooped is prbly still unrelated but now I hate everything

Lol, I think someone managed to nab the patreon name "oauth2" so now when you visit https://www.patreon.com/oauth2/documentation you get some random user

Ist es nicht total verrückt, dass alle bisherigen Regierungen noch nie ein Gesetz verabschiedet haben, das hinterher vom Bundesverfassungsgericht einkassiert wurde, weil Armutsbetroffene, Migrant:innen, Behinderte, Frauen oder queere Menschen extrem begünstigt wurden?

Oder hab' ich was verpasst?🤔

"In 500 years they will dig up your bones and they will know you were a maaaaan!"
"I'll deal with that when it happens."
"You stupid? You llama be dead for 500 years!!"
"Ah, see. I knew there was a reason why I didn't care."