HN user
I just provided a more direct link but yeah it is just proposed at this point. The age assurance part appears to be substantially similar (very similar verbiage) to the bills that have already passed in California and Colorado though so I guess we'll see it again in a few weeks or months at this point.
From the General Assembly's website: https://www.ilga.gov/Legislation/BillStatus?DocNum=3977&GAID...
There's already models specifically for things like identifying players in Counter-Strike 2, including which team they're on.
Someone has even rigged up a system like that to a TENS system to stimulate the nerves in their arm and hand to move the mouse in the correct direction and fire when the crosshair is over the enemy.
We are definitely already there.
There are some things regular distros can't/shouldn't do, like including codecs still under patents, matching proprietary Nvidia drivers with the correct kernel version, proprietary firmware for game controller adapters, the launching of Steam Big Picture mode as the default UI, etc.
I believe it's: sanm LucasArts SANM/SMUSH video
Popped in that context means hacked. Like in the same usage of pop in "popping a shell".
I do not think he meant it as any kind of physical/death threat.
The domain that the verifier (the site trying to authenticate you) is at is part of the cryptographic process. If the domain doesn't match (ie you're at a phishing site) then the results of the cryptography won't be valid for the actual correct site, only the phishing site (which gets the phishing site nothing it can use).
It's been supported by qBittorrent since 4.4.0 released in January 2022 when built with libtorrent 2.0. The official docker images still use libtorrent 1.2 though as that is the default.
Probably not a dealbreaker for most but it might be hindering Bittorrent v2 adoption.
qBittorrent put out version 5.1.2 over 2 months ago:
> Wed Jul 02nd 2025 - qBittorrent v5.1.2 release
> [...]
> qBittorrent v5.1.2 was released.
> SECURITY: It contains security fixes for the WebAPI, Rss and Search modules.Lack of a tagged stable/release version with libtorrent 2.0 for one.
ID.me is actually a private company.
The US government does have login.gov though.
For Windows apps there's: https://en.wikipedia.org/wiki/WoW64
Bluesky feeds are still server-side (due to needing to process all of the available posts to generate the feed) but at least you can choose which ones to use and people can make their own, which is an improvement over a single app-provided algorithmic feed.
The distro package in question here is a Fedora-specific Flatpak, not the Fedora-specific RPM distro package version. From my understanding, it is missing things like patented codecs which then causes bug reports to be filed with upstream, OBS, instead of the ones responsible for the package, Fedora.
Fedora has its own Flatpak repo as the default instead of Flathub (which has the official OBS package from the upstream developers).
That's if he had gone with the delay mechanism built into the law if there was a plan to sell it in the works. This is just ignoring the law.
Google Authenticator does support exporting and syncing now:
https://security.googleblog.com/2023/04/google-authenticator...
I think their point was that it's less phishable from the perspective of needing the attacker to try logging into the site with it in realtime instead of being able to just store the password for some later time. The needed concurrency makes it more difficult (if only slightly).
I'm curious though why you don't think TOTP or similar are good against credential stuffing though, would you be able to expand upon that?
From my understanding, it didn't scan all of the files on the device, just the files that were getting uploaded to Apple's iCloud. It was set up to scan the photos on the device because the files were encrypted before they were sent to the cloud and Apple couldn't access the contents but still wanted to try to make sure that their cloud wasn't storing anything that matched various hashes for bad content.
If you never uploaded those files to the cloud, the scanning wouldn't catch any files that are only local.
A law by the government requiring proactive scanning of photos would in fact make the whole situation worse in the US because there would need to be a warrant if the government is requiring the scan. As long as it's voluntary by the company and not coerced by the government, they can proactively scan.
A passkey is a synced, discoverable WebAuthn credential. While many implementations protect the private keys with additional security measures like secure enclaves or TPMs, it's not required. If you want to use an implementation that doesn't use those types of lock-ins, even when they're there to protect your credentials, you can. Multiple software-only implementations exist.
Generally attestation is not supported outside of enterprise contexts and Apple for example doesn't support it without mobile device management policies being applied to the device.
You can make your own backups of passkeys from your password manager.
I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).
They do have a web page to do pairing at least:
Matt's side wanted WP Engine to cover what seems to be the costs of running the entire wordpress.org site but the judge didn't go for that:
https://www.courtlistener.com/docket/69221176/64/wpengine-in...
Defendants [Matt's side] counter that a bond of $1.6 million is appropriate. Opp. at 32. They assert that “the continued maintenance and operation of the Website incurs an estimated $800,000.00 in administrative, server and developer costs per year[,]” and that allowing WPEngine to access the developer resources of the Website permits WPEngine to benefit from the distribution of its products on the Website[,] which “carries with it a separate value.”
[...]
In reply, WPEngine argues that if the court is inclined to require a bond, “it should be a de minimus amount, not wordpress.org’s entire budget for two years.”
[...]
Under these circumstances, the Court finds that any harm to Defendants resulting from the issuance of preliminary injunctive relief is unlikely, as it merely requires them to revert to business as usual as of September 20, 2024. Accordingly, the Court declines to require WPEngine to post a bond.
It's a standard supported by multiple parties, not just Microsoft, including multiple open source password managers.
And it does provide some benefits: phishing protection (no shared secret that can be intercepted or given to the wrong party) and the service does not need to store as much sensitive information (don't need password hashes that could be leaked and cracked, just a public key).
Basically the same as if you had lost a physical key:
You either have an extra set up or you work around the problem through some kind of recovery method.
Or things like Web USB start getting used to provide useful features without needing to install whole apps, like mouse/keyboard dongle pairing, phone OS flashing, etc.
As far as fingerprinting/tracking goes, I have never seen a random site prompt for these features, only apps where it makes sense.
Here's the actual link to the starter pack: https://bsky.app/starter-pack/bradgessler.com/3laa47lbuwb2r
https://docs.bsky.app/blog/blueskys-moderation-architecture
You can either rely on Bluesky's standard labeler only or subscribe to ones that handle certain niches or the higher standards of moderation that you may want.
There's also lists made by other users that you can use to just block all the trolls/bots/etc on them at once (and as more are added).
97% with a pihole and uBlock Origin Lite. 99% if I turn the filtering mode to "complete".
You don't. Same as a physical key for your home, you have backups.
Whether that's having multiple separate keys/devices registered with your accounts or a single key stored in a password manager, you need to have a fallback plan.