aPoCoMiLogin

this is false equivalency. in poland we have similar to passkey implementation in government issued application - mobywatel [0] that allows to login to government websites. in 2022 according to published data it had almost 9m installations [1] and a lot of them are old ppl, so its not like only neckbeards would know this ancient technology

sure there are some issues sometimes (outages and others), but most of the time they work like charm and solve a lot of issues with login+password issues.

- [0] https://play.google.com/store/apps/details?id=pl.nask.mobywa...

- [1] https://dane.gov.pl/en/dataset/2919/resource/43845,mobywatel...

this doesn't sound like the passkey is the issue, is the implementation or the missing implementation issue.

in poland we have similar to passkey implementation for government profile, that is then used to login to most/all government websites or to sign government documents. you point the camera on the qrcode, confirm it on the phone and you are done. this same app has your ID, which can be used in most places (shops, banks, police etc).

and btw im using linux (main box), macos, android and ios - no issues so far with really cross device usage

i don't think you really understand how it works. most implementations are secondary implementation alongside login+password.

how to use cross-device? either use some password manager that supports it (apple/google/1password/keepass/etc support it), or use device that you have on hand most of the time - phone. when the passkey pops up - point your camera and scan the qrcode - you are done. otherwise use dedicated device like yubikey or similar.

really not sure what is hard about that to understand. i'm using android and chrome, so i can use the password manager in chrome, or my phone to scann the qrcode.

my country is using similar authorization for government "profile" (mobywatel - poland) that has similar to passkey implementation. you download the app on your phone, login via login+password (or other), download the certificates, and from now on you can point your camera on qrcodes to login to government websites; it requires pin/code or biometric confirmation on the phone - same as passkeys.

if only that would work

to be honest, the way compound index is implemented in mongo is problematic (index intersection never worked for me). you have to tinker a lot sometimes, so the query params are in the right order so the query planner don't decide to pick other index or not use index at all.

not sure if this was fixed in recent versions, but if you have index on array of strings/ints, and then use `addToSet` operator, the index is not used for the `addToSet` operation, and the disk is hammered for each update to verify if the content of the array has unique values. with pretty high volume, you can easily saturate the disk queue, wondering what is happening and how you can fix that

after few years of working with few TB collections (tables) in mongo, I can say that this DB is good if you want to insert data, but don't need to read the data that much often. if you need json and read heavy DB, consider something else eg elastic (with all it's drawbacks), because at some point the limiting factor for you will be indexes in mongo, that are the most weak part of this DB (even more weak than the infamous data loss)

can you link these issues? i'm planning upgrade from 22.x but i'm afraid of some breaking issues. also did you upgrade or reinstall ? if upgrade, were there some issues with that ?

not gonna happen, the issue is very deeply rooted already, you can't change that without force

it's the other way around: `wait_for` waits for the next refresh (there is configurable refresh interval, 1s by default), `refresh: true` forces refresh without waiting for the next refresh interval.

the difference is that waiting for refresh assures that the data will be available for search after the "insert" finishes. forcing refresh might be foot gun that will criple the servers.

most of these is more lack of experience than the DB fault. most systems have its quirks, so you have to get used to it.

in my case, i ultimately introduced linters, formatters, git hooks, gh actions, etc. i've tried to explain and tried other things, but it felt like babysitting at that point. if someone is unaware of their own weaknesses, there isn’t really much you can do about it; you'll just end up fighting, which will make both of you resent each other

make everything as code, introduce linters, formatters, hooks and checks. when you work in a small team with people of a relatively similar mindset, such things aren't necessary, but when the team grows, there will always be issues with such things. so having a mechanism to enforce rules is necessary for your own sake

very nice. there are things that won't show up in the network panel and you had to resort to proxy for debugging, especially when you are using puppeteer/etc for testing.

recently had to research "residential proxy", and the number of websites that claim that they have millions of IPs on hand was very strange. then the fact that a lot of them work in the exact same way, and a lot of them accepted payment mostly in crypto was very strange. so now connecting the dots, makes sense now why these "residential proxy" websites looked and worked the same way

it happened because the story of dependencies (system & application) was terrible. the ability to run the app on different distribution/kernel/compiler/etc was hard. there were different solutions like vagrant, but they were heavy and the DX wasn't there

exactly, i'm using "google phones" since nexus s, and they always have some discounts few months after release. other thing is that they currently offer 5y of updates, so even one year later with heavy discounts the phones are still good. i've got my P8 Pro with 1/3 discount

it is madness, you would be surprised how many ppl take things too serious. been there, had talk with HR cause i've said that the solution is mediocre and we have to do something better than that.

prepend medium url with https://freedium.cfd/<medium_url>

You can do that

I second to that. Had plenty of issues with other routers, after switch there was no issues at all in the last 3 years

it doesn't make them worse, they just stay at the same level. the tool doesn't change that the person using it doesn't care about the end result.

making systematic mistakes is the trait of the character, there is nothing that can fix that, except the subject itself

you are the CEO of ACME company, one of your employee broke a law but in the name of your ACME company, you are going to jail.

very shortcoming rhetoric

One of my programming mantras is "no black magic." If I don't understand why something works, then it's not done.

so many ppl nowadays don't care about knowing how thing works, they just push shit and cross the fingers.

can recommend as well, it's really great way to learn by game/example

a lot of fixes are kind of workarounds

i've switched to keepass right after first breach. it's not convenient to store the db on eg gdrive and sometimes it doesn't work, but that is way better than another SaaS app that will eventually leak my passwords/2fa codes.

rarely saw such uses in the wild, which always breaks my mind. although the filter+map|reduce combo is the most popular that i've saw

i only want the score to represent real threat, not what features it includes, as that is meaningless in the long run. i agree that it shouldn't include "i think is bad" as that is meaningless as well, the score should represent the threat, not the features.

because i'm checking dependabot [0][1] regularly, there is a lot of issues with very high scores for frontend libraries, that have really low impact, because it "checks" some features. eg some plugin for jquery (frontend lib) [2] that has the same score as heartbleed, which is insane and shows how useless the score is in current form.

- https://docs.github.com/en/code-security/dependabot/dependab...

- https://github.com/advisories?query=type%3Areviewed

- https://github.com/advisories/GHSA-ffmh-x56j-9rc3

here's recent openssh RCE classified as 9.8 https://www.qualys.com/regresshion-cve-2024-6387/

the difference: you can find affected openssh servers, with the node-ip issue you have to find very rare instance that would allow for SSRF and create exploit for the exact use case. with openssh you can make it really broad.

so the 9.8 score for node-ip is crazy high, and nobody should question it, it should be ~6 max

the CVE for the node-ip requires also few special conditions - very uncommon format (never seen IP in hex anywhere), use of `isPublic` function (this lib has more functions), and even if this two conditions were meet, there is still one more condition - the ability to do SSRF. 9.8 score in this case is crazy.

don't get me wrong, it is an issue, but not critical, making everything critical, for frontend libs on npm creates fatigue and nobody takes these scores seriously anymore. in case of real issue, nobody will care enough to patch it, as everything is critical.

OP was playing with wasm and saw 10x increase compared to JS

GCP/Gdrive/Gdocs is not putting ads anywhere, and the list can go on. what they are doing, they are looking for other streams of money