HN user
Except enrollability. Got a new account? You need physical access to both tokens to enroll it. Got a new token? You'll have to individually enroll every website - provided they even support multiple tokens at all...
Yubikey tried to solve this, for obvious reasons. Their proposal was DOA.
Tried this, they weren't even able to verify my ID for KYC reasons. Had to go a second time after they blocked my account with zero warning. I have zero expectation that they will be able to help me with a password reset
Sales. They are there to talk you into getting the premium mortgage.
How do we verify that you are you? It can't be linked to fingerprints, iris scans, or DNA, as those are trivially leaked, impossible to change, and a privacy nightmare.
Until we find a way to securely implant a Yubikey in people's brains, it isn't going to happen.
Easy: it's the token on your physical keyring, right next to your house key and car key.
Yeah, but it's an order-of-magnitude more complicated. It's no longer "click a link and fill in your creds on a legit-looking website", it turns into "hack someone's email, request a password reset, wait the mandatory 24 hours, do a social attack on the provider to pull off a sim swap, and fill in the 2FA code".
Your master password to your cloud PW manager's vault is also phishable
... which is why all sensible cloud vaults have a separate enrollment key, requiring an explicit action to grant a new device access.
at which point it’s no different to password syncing
You still get the phishing resistance, though!
Exactly. Bitwarden, not the Apple/Google/Microsoft keychain. That's the problem.
The original U2F tokens didn't suffer from this problem that much. It contained one secret, it relied on the website to store and return an opaque website-and-account-specific blob, which was decrypted by the token and used to sign the login request. It would be reasonably easy to expand this in a way where the server also stores a backup credential for use by your second/third/whatever hardware token, encrypted with an asymmetric key during the enrollment of the primary token.
But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.
The wing isn't supposed to fall off, for a start!
Stop using all Russian tech for the illegal Ukraine invasion, stop using all American tech for using the illegal Iran war, stop using all Chinese tech for the Uyghur genocide, stop using all Arabian tech for their modern-day slavery, stop using all (most?) European tech for their direct support of the Palestinian Genocide...
Very few acceptable countries left, it seems. Canada, maybe?
Same reason the Musk Corporate Universe does everything else: because Elon woke up and thought it would be cool.
I don't even care about the tuner part. If I ever get the desire to watch linear TV again, I'll just get an IPTV subscription.
A decent-ish TV-sized panel with at least a single HDMI input really is all I need.
That can also be trivially done without a biometrics database: just collect and compare when they become a suspect!
Still a few orders-of-magnitude off, though.
Hobbyist electronics manufacturing has always been reasonably affordable, with the old perfboard / stripboard from RadioShack having been a staple of the hobby since forever. At-home etching was also available for the people who cared more about having cool PCBs than about having healthy lungs.
The availability of cheap factory-made low-volume PCBs goes hand-in-hand with the switch towards smaller and smaller SMD parts. You don't need a professional PCB for a few THT parts, and you can always put the odd SOT part on a breakout or dead-bug solder it. But when many interesting parts started to become available only in QFN/DFN (or worse: BGA) packages, proper PCBs became the only option. Combine that with PCB factories wanting to make a few extra bucks off of their wasted board space, and it is suddenly quite attractive to hack together a quick-and-dirty ordering page for hobbyists and prototypes. No new technology needed, just a new market waiting to be served.
$4 / die custom chips are indeed very attractive, but the $4000 MOQ is not. A high-school or college student just getting into electronics can afford spending $100 on a hobby project just to discover it is broken, but there is no way they can afford spending "used car" money on it. That's startup territory, or "retired Bay Area engineer" territory.
Unfortunately they still run into the same basic economic problems: a wafer might be only $1000, but a set of masks is closer to $100k. This means you want to maximize the number of wafers, with ideally each wafer only containing a single copy of each chip. But even if you assume they just fill a reticle to the absolute maximum with unique chips (let's call it 40 unique designs) and fit, say, only 25 copies on a wafer, that's still only 40 wafers, so $2500/wafer in one-off costs - completely dwarfing the actual wafer itself.
For hobbyists you want a process closer to $10k / wafer with zero mask costs. Fit the same 1000 chips on there as before, and you can now sell people 5 copies of their chip for $50. That's a completely different game!
It is likely to be 1.1 speeds, and considering that USB-B connectors are chunky and dying out it is likely going to be cheaper to go for USB-C.
USB-C connectors from well-known brands start at less than $0.20, USB-B ones are $0.30. Same story for the low-end: C can be found for as little as $0.011, B starts at $0.05. Resistors are basically free - about a cent a piece if you splurge, more like $0.0007 if you really push it.
With the EU practically mandating USB-C on all portable electronics, the market is rapidly shifting towards it being the default for all 5V-powered gear: either you ship a cable/brick with it, or you give it USB-C. Even with a premium connector it is quite obvious which option is cheaper, so even bargain-bin gear is incentivized to adopt USB-C, which in turn pushes the connector manufacturers to develop dirt-cheap USB-C options.
OP mentioned in another comment that a decent chunk of users is elderly, and C-to-B cables (albeit rare) do exist, so confusion isn't impossible.
I personally really don't like it in a world where everyone has USB-C power bricks readily available and USB-B cables are dying out, but considering the user base it is not an entirely unreasonable design decision - for now.
The ESP32-S3 includes ±2 kV ESD, which is respectable.
This might not quite mean what you think it means, by the way. In practice it is almost always just a property of the IP macro they use for the physical GPIO design, and its functionality is not tested - at all.
The reason for this "eh, good enough" approach is that it is intended for potential shocks during manufacturing: they don't want it to definitely die during a freak shock in an ESD-controlled environment. The rating is only for single shocks (so no repeats, as you'd see in the wild) and only for 2kV (not the 15kV you'd see in the wild, let alone the odd 30kV one for static-prone people) because that's all it is going to encounter during assembly.
I made the exact same mistake with one of my first commercial designs. And then after a while the reports of weird cases of single-pin GPIO failures started rolling in...
The AMS1117 is just more available than the alternatives.
Keep in mind that this is both a blessing and a curse. It is more available because there's a giant number of clones, all of which are going to behave slightly differently. Your design with MLCC capacitors is outside of the regular operating parameters. It might work fine now, but don't be surprised if it starts failing on the next production run because the fab substituted it for a different AMS1117 clone to save a few cents.
At 2500 units your run is big enough to order whole reels of parts. There are dozens of drop-in replacements for the AMS1117 which are perfectly fine with low-ESR capacitors. Considering your sales price you should be able to afford splurging 5 more cents on a proper modern alternative from a reputable brand, so why take the risk?
When making decisions like those it is important to ask yourself one crucial question: can your brand survive both the financial and the PR blowback of, say, a 10% failure rate on your next batch? When you are selling a premium product at a premium price - and you are - your customers expect premium quality as well. Ironically, you literally can't afford to cheap out on parts.
But at 3.3v and 232 mW it's not a fire hazard. It will fail open
"Fail open" in practice means "catches fire". Will it spread to other parts? Probably not, if everything goes well! PCBs are fairly hardy (the "FR" in FR4 stands for "flame retardant", after all), your parts are fairly spaced-out, and there's even a chance you might've used an overkill self-extinguishing plastic for the housing. But can you afford to ignore the potential risk? How will your customers react when it does an Nvidia 12VHPWR and the freak 0.001% failure is suddenly front-page news for your community?
Hardware design isn't merely about making it work. Things like design for manufacture/assembly (kudos on the one-screw method, by the way!) are just as important - as is designing it for reliability. Your work isn't done when it functions, but when it can't reasonably fail in any way that matters.
Same with ATMegas: I was working on a product line which was based on the atmega32u4 for legacy reasons. They became unobtainium and our platform recently started gaining RP2040 support - which was readily available at lower cost - so the decision to switch wasn't too hard.
Technically it doesn't - it just needs to be compliant.
It is completely left up to you how you are going to demonstrate this if they ever come asking for the paperwork proving this. This can be a certification by an independent testing lab, documentation from in-house tests, or perhaps even documentation proving that it is compliant by design.
Notably, that link does not repeat that "some Chinese factories were claiming...". It just states that some people put it on noncompliant products. It is unclear whether any Chinese factories ever made that claim.
Because there's a never-ending stream of plausible use cases where it just missing one little option. Just look at the web: people have done all sorts of horrible stuff in Javascript to make up for missing HTML / CSS properties.
At a certain point it becomes incredibly tempting to just give up on playing whack-a-mole and let the most demanding users do it themselves using a proper programming language.
I'm glad to hear that! Someone should probably update the Wikipedia page they link to in the changelog, then.
If they are solely doing it for legal reasons, I would expect some form of malicious compliance - like an accompanying blog post explaining how it'll be marked as "Firefox is legally required to tell you the EU considers this page safe. We disagree. [Learn More]" and that the mark will only be shown to EU users.
Complying to the exact letter of a stupid law to avoid getting sued is understandable. Voluntarily complying to the broadest interpretation without any pushback is not.
Firefox now verifies and displays Qualified Website Authentication Certificates (QWACs) in accordance with eIDAS regulations.
Interesting that they just buried this in the middle without even a screenshot, considering how hostile Mozilla has been to the proposal in the past[0].
Considering that they previously made quite strong arguments that implementing QWAC would undermine security by completely bypassing the existing CA trust process and violate user's privacy by leaking browsing activity to third parties: what changed?
It does seem to fit into a wider movement, though. Mozilla previously explicitly considered WebUSB, WebHID, and WebMIDI as "harmful" as they lacked an effective mechanism against hostile websites tricking users into permanently compromising their hardware. This switched to "neutral" without addressing the underlying issue, seemingly just to satisfy some users asking for parity with Chrome out of a convenience argument. Same with Firefox happily jumping onto the AI bandwagon, and only backtracking after major public outcry.
Not to be dramatic, but Firefox seems hellbent on rapidly turning into a reimplementation of Chrome, completely ignoring its raison d'être. Will there be any traditional user-serving browsers left a few years from now?
[0] https://s3.documentcloud.org/documents/21330628/mozilla.pdf
The hard part is getting the NIMBYs to let you build any truck stop. Adding a bunch of chargers afterwards is a piece of cake.
You can, but (at least in Europe) it is rarely done.
A big problem is that it doesn't count as a daily rest if the vehicle is moving. This means in practice that the longest you can drive in pairs is 4.5h A, 4.5h B, 4.5h A, 4.5h B, 1h A, 1h B, followed by at least 9 hours downtime. Still a 20-hour non-stop drive, but not even remotely 24/7. You'd need additional standby drivers at a remote base, at which point you could also just swap the trailer to another truck.
In practice this means it is rarely worth it. Combine it with the schedule going out-of-sync with the days, and for regular freight it is almost certainly more expensive than just giving each driver their own truck.
The exception to the rule is high-priority cargo which for one reason or another can't be done via air. Take Formula 1, for example: with back-to-back races they have just three days to tear everything down, drive it across Europe, and build it back up again. It's a 15-hour drive without any delays, so having a solo driver rest for an additional 9 hours halfway through is unacceptable. With a driver pair it is easily achievable, and the additional costs are irrelevant.
What annoys me the most is that they are so damn obvious! I can understand patenting the steam machine, but most software patents are simply the first solution which would come to mind to any developer encountering the same problem.
What's next, I can charge people money for using the number 65234563124 because I'm the first to file a patent for it?
But that's the thing: you already have to pay a driver to sit around!
In Europe there's (simplified) a mandatory 45-minute rest break after 4.5 hours of driving. Similarly, there's a mandatory 11-hour rest period after the daily maximum of 10 hours of driving. And it is very strictly enforced, with every commercial truck having been equipped with a sealed and certified data logger, plenty of random checks by traffic police, and heavy fines for any kind of violation.
If the truck is already sitting idle ~half of the time due to driver rest requirements, why not take that opportunity to charge it as well? Similarly, if you are building the usual highway-side rest stop with truck parking, a petrol station, and a restaurant, why not add a charging station as well? It can even do double-duty as rapid car charger!
The buzzing is pretty obvious when it is rainy or misty. I passed a power line during my high school bike commute, it never failed to amuse me. I wouldn't call it "loud" though: noticeable, but the average traffic noise is far worse.
The leukemia is bullshit, though. The numbers are too small to make any kind of definitive statement, or to properly compensate for things like socioeconomic factors - plenty of other potential causes on the rural farms and poor urban neighborhoods where we usually build power lines, after all.