anfedorov

I think he means if you're serious about dark mode then design two graphs one light, one dark. Solving "how do I turn a well designed light mode image into a dark mode image" is an AI task that would be a nice research paper, not something a designer can hack together with a bunch of if-then rules.

Worth noting, in similar vein — https://protonvpn.com/support/macos-ikev2-vpn-setup/

Also, what does "Clean Electricity" mean? I signed up for CleanPowerSF which only cost me 2¢/kWh more, if I remember right: https://en.wikipedia.org/wiki/CleanPowerSF

There appear to be two points being conflated — 1/ 2FA via secrets stored on a separate device from your primary device with a PM provide more security than those stored on one device, and 2/ once you use a PM with unique password for every site, much of what OTP helps with for is already mitigated.

Both seem true, and what to do to protect yourself more depends on what kinds of attacks you're interested in stopping and at what costs. Personally, PM + U2F seems the highest-security, fastest-UI, easiest-UX by far — https://cloud.google.com/security-key/

That may be a bad idea — you have entered into a contract, one that likely doesn't account for that sort of "cancellation" and so gyms could legally keep charging you, consider the account delinquent for awhile, then close it and sell that debt to a collection agency. On the other hand 24h fitness auto-canceled my membership when I didn't go for a little while, so at least some have some kind of incentive to not have people hate them.

Not quite exactly "equivalently bad", since a user is more likely to notice a 2FA setup change than they are a phishing site's login error and then everything working as usual, but yeah, perhaps it's splitting hairs at that point.

If you're using a password manager to have unique passwords for every site, what does TOTP 2FA even protect you against?

Sounds a little obvious to write it out, but it protects against someone stealing your password some way that the password manager / unique passwords doesn't protect you against. Using a PM decreases those risks significantly, mostly because how enormous the risks of password reuse and manual password entry are without one, but it certainly doesn't eliminate them entirely.

I haven't read all the indictments and so might be wrong, but at this point I think it would be speculation. Time will almost certainly tell for sure. The wikipedia definition of the term seems easy to agree on — https://en.wikipedia.org/wiki/Asset_(intelligence)

At least some of that seems in the past. Presently, Schindler has good coverage of the details here [1], which details what a generous reading of mkempe's point is trying to say -- let's not go over-board.

1. http://observer.com/2018/07/putin-conflict-poland-ukraine-na...

Sigma (https://sig.ma) | Software Engineers, Director of Engineering | Millbrae, California | full-time | ONSITE / VISA transfers

We're bringing memberships, certificates, licenses, and credentials into the connected era via a platform built on Scala, GraphQL, and React.

More info: https://angel.co/sigma-certified/jobs

to apply, contact eng-apply@sig.ma or andrey@sig.ma with questions

Could the browser create a tight whitelist of payloads that are definitely not hostile, then expand it slowly to add functionality?

Why is it an obviously bad idea? In light of the work on NaCL, is there still no way you can imagine it could ever work?

Aside from the "no HID" (does a YK even count as a HID if you turn off the default slot 1 functionality?), was the proxy designed to have a firewall / sandboxing of some sort? Google engineers have done some incredible things and while ambitious, it seems this kind of thing is well within their reach.

Was there some work-around I'm missing or did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". Because the folks at Google Security are definitely smart and many orders of magnitude more experienced than me, and that's a vuln even I can understand / see the problem with so something institutional must have gone way wrong if WebUSB shipped on the stable release without some kind of block-U2F-forgery filter.

As far as Yubico, I get that they are doing something pretty hard in the hardware / product-market-fit domains, and I respect that and I want them to succeed, but they appear to be seriously dropping the ball on the software part of their product [1], as well as "simplicity breeds security". They could do so much better on the actual UI/UX if they piece-by-piece copied the setup UX of a "smart" vacuum cleaner.

1. I emailed & on-site support ticket submitted them days ago about some of their certs having expired on 2017-05-10, and have gotten not a peep in response & no fix in sight. Did nobody set a team calendar reminder and is nobody responsible for checking it on a monthly / quarterly / at the very least end-of-year cycle? That seems pretty elementary "underwear goes inside the pants" kind of security competence.

https://i.imgur.com/bOCfXJ2.png https://developers.yubico.com/yubikey-neo-manager/Releases/y...

Noting conflicts of interests makes sense, but the point of the article may still stand. Why is there no market force for extracting CO2? Do any emissions trading systems include folks who capture emissions and improve the "supply side" of the equation?

Sounds like there was bad blood or a general cultural problem there already. I can't imagine a well gelled team of people who like each other ever being unable to solve this kind of problem.

An employee should be comfortable going to their manager and their manager's manager about problems like this, and a manager should "nip it in the bud" when an employee begin running such "little pseudo-managerial experiments" on their colleagues instead of voicing your frustrations directly. What even is a managerial experiment? Colleagues and subordinates are not experimental subjects.

Are there any serious comparisons with package managers versus curl-to-bash? Seems as if there are a lot of trade-offs.

If all of the models line up a ton, an expert witness could explain that these the chances of reaching the same tuning on all these choices via independent work is practically 0.

Not in the context of impersonating Boris Johnson's IP they are not.

Sigma (https://sig.ma) | Software Engineers | Millbrae, California | full-time | ONSITE / VISA transfers

We're bringing memberships, certificates, licenses, and credentials into the connected era via a platform built on Scala, GraphQL, and React.

More info: https://angel.co/sigma-certified/jobs/130819-software-engine...

contact eng-apply@sig.ma or andrey@sig.ma with questions

OK, then perhaps Dunning–Kruger effect.

Hayden does does not agree with you on this issue.

I get what the controversy is about, but I don't get how this is OK from Strava's PoV — none of my runs are "public" in the sense that I think of it — they're not on the website that's my "profile" and they're not visible to people who are not following me in the app...

What about them?

I'm a quasi-active user and never realized my updates were public beyond the people who followed me. It has absolutely no UI indicating it the way, e.g. Facebook does, and does not show me any activity of people whom I do not follow.

Doesn't look like they're actually public, though? https://www.strava.com/athletes/22230419

I can think of more than one well-regarded unicorn where everyone still has access to basically everything

Hard to be sure, but GitHub support signed up for a friends-only beta of one of my products before I had told anyone outside my immediate circle about it.

What do you think corporations do to their corporate laptop disk encryption? Have only the employee be able to access it?

Link? Curious how one would go about measuring, e.g., criminal insider trading facilitated by wide-spread e2e encryption.

Violent crime, gun crime, murder rates.

What other kinds of crime are there, and how would you measure how much of it there is?

Sounds like you're in a bubble. There's reasonable people on both sides of this debate, even if some of them are wrong: https://www.youtube.com/watch?v=6HNnVcp6NYA

Source?