crotchfire

Would be interesting to combine this with a web-of-trust.

None of my one-hop trusted people are part of the cancelmob. If I found that somebody two hops away from me did something absurd it's quite easy to do something about it -- apply negative trust to whatever path endorsed that nonsense.

Unfortunately people these days seem allergic to running anything that isn't a web browser or served by an app store, and the entities that control those two channels are extremely unexcited about decentralization.

https://ryf.fsf.org/

... and how they steer the discussion from "social media" to "screen time".

Wikipedia helpfully selected a picture of somebody using an ebook reader as their illustration of what "screen time" means: https://en.wikipedia.org/wiki/Screen_time

I'm just flabbergasted with the level of smokescreen that goes on in this discussion. Pretty sure reading books on ebook readers is not what is driving teenage mental health problems.

It's okay, the Cargo Lords promise me that because they require a git-hub account and agreeing to the git-hub terms of service before contributing, everything will be okay.

They pinky-swear.

Unfortunately github appears to be actively breaking the ability to use git-bug on repositories with large numbers of pull requests (like nixpkgs):

https://github.com/MichaelMure/git-bug/issues/749#issuecomme...

They really don't want you to leave their walled garden.

where a repo is forked but the new maintainers don't change the repo's did

A DID is a public key. If you don't know the corresponding private key you won't be able to make any updates. All you'll be able to do is mirror it.

instead just get more nodes to follow them than the original

This is like saying "but I can fork Verisign's Root CA certificate and get more nodes to follow me than Verisign!". No, you don't have the private key that goes with that root certificate. So everybody will ignore you.

Cryptography is not a popularity contest.

You're an LLM, right?

Oh please with the karma-farming.

Suburbs, for better or for worse, have been around for a long time. They cannot explain the massive decline in Generation Z's mental health compared to its predecessors.

PS, next time try to link to housing costs -- that one gets better karma yield. Bonus points if you can somehow denigrate cryptocurrencies while you're at it.

To use the Mastodon web application, please enable JavaScript. Alternatively, try one of the native apps for Mastodon for your platform.

Mister The Plague.

The "one-knob, self-adjusting" way to implement this is a revenue-neutral size tax: https://news.ycombinator.com/item?id=39235533

AI eating jobs, there's zero mention of whether it could come for management positions. Nothing. Curious, isn't it? Why wouldn't an LLM be good enough at this?

There's a whole book about this, called Rainbows End. Highly recommended.

How does this end?

War, unfortunately.

You have misunderstood the notation; Noise NK is 2 messages, one round trip.

Exchanges above the dotted line are one-time key distributions; see this link: https://archive.li/bU5Me#selection-3667.0-3671.36

Protecting against "swapped devices" is simple: put a secret key in the device, ask it to produce a signature, check it with the public key. Any device other than yours won't know the secret key.

I'm not sure what attacks you refer to when you say "malicious program-binaries". I'm having trouble imagining something fitting this description which is thwarted by the vendor blowing the programming fuse but isn't thwarted by you blowing the fuse yourself.

10c per HN post

Apparently some people haven't heard about Stacker News (okay it's more like $0.0001 per post, but anyways...)

Why not buy a TKey Unlocked instead? https://tillitis.se/products/tkey-unlocked/

Then you not only have access to the device secret, you can even choose it yourself.

https://news.ycombinator.com/item?id=39835927

This is Noise NK, possibly with differences in the hashing details which I did not check:

https://noiseprotocol.org/noise.html#interactive-handshake-p...

I encourage you to use their hashing details. They're battle-tested.

Wireguard uses Noise IK, which is NK plus a static public key for the initiator which is encrypted to the agreed-upon-session-key without adding additional round trips. Your protocol and Noise NK omit the parts related to the initiator's static public key, because it has none.

Telemetry.

Sure: you replace the hardware with brand new hardware and it keeps happening. Then you know it's not the hardware.

Can you point to any botnets which were built using rowhammer attacks?

Rowhammer and speculative execution attacks are incredibly labor-intensive and target-specific. They are targeted attacks for high-value targets.

It will detect (by crashing) enough to make exploitation impractical. That is the key point.

What about DIMMs with Error Correction Codes (ECC)? Previous work on DDR3 showed that ECC cannot provide protection against Rowhammer.

This is incredibly misleading. The paper they cite states:

When the ECC detection is used correctly 0.65%-7.42% of all bit flips still cause silent corruptions... On setup AMD-1, uncorrectable errors crash the system.

The attacker will need to cause dozens of machine halts in order to achieve even a single exploitable bitflip. Dozens of machine halts is not something that goes undetected.

Kudos for calling out JEDEC's terrible behavior on the rowhammer question, but we should not be downplaying ECC as a near-term solution.

Users are not your guniea pigs, either.

To convince people to use something, what you're proposing needs to be less-broken than what they already have. The whole "let's burn down their house because they don't want to move to the new one we built" attitude is a disgrace.

I use Sway (a Wayland compositor), but I'm embarrassed to admit that when I see the WaylandBrigade pulling crap like this.

Correct. It's explained here:

https://github.com/libsdl-org/SDL/pull/9345#issuecomment-201...

XWayland has special hooks into the compositors that normal wayland clients don't get.

Best comment: https://github.com/libsdl-org/SDL/pull/9345#issuecomment-201...

SDL is not your tool for "signaling to stakeholders" about what is important.

But but but I need engagement for my team!

You can't avoid it during account creation.

So they still have the number.

This is exactly what Lloyds does.

"global culture"?