jtrn

It was misleading by me also. As mentioned, terrible work day yesterday, so I was writing angrily. Ironic that I accuse the security people of being bad at explaining, then turn around and explain stuff badly myself...

Ill TRY to make it up by explaining it as i understand this.

This is not adding the pin functionality, I was just focusing on the flow that happens when you get the Fido2 challenge flow on a webpage. That functionality is already there. Thee new thing is the 5.8 ads support for a second roundtrip/flow for signing stuff in browsers.

Right now, a YubiKey does only one thing in browser: signing a "login challenge string" from the webpage (FIDO2 flow). This is just slightly simplified: (random number + domain + some other shit). Fingerprint that string and return that cryptographically signed result to the site, as proof that "Only I could have signed this login challenge."

Right now, that's the only supported back-and-forth flow for signing anything with a YubiKey vs. a browser.

The new thing is that YubiKey wants a second flow, where the browser sends a request to sign any arbitrary text. So the page contains a contract, converts that to a fingerprint, the browser sends the fingerprint to YubiKey, YubiKey cryptographically signs this, and you can post the resultant string anywhere (public key cryptography magic), and that proves that the person holds that hardware key signed that exact input string (the contract).

So if/when Chrome, Safari, Firefox, and more accept this standard, you could click a button below a contract on a webpage, and the back-and-forth dance with the YubiKey would result in a string below that contract being cryptographic proof that the exact contract above is signed by the person holding one specific key.

Notice the lack of any AI-related shit in this functionality, yet the article reads 5.8 is a revolution for security in "the AI era"

Perhaps you should look at the announcement. Of course webauthin is in the browsers. They didn’t announced that they now support webauthn??? I said the webauthn THING because it’s an addition to that functionality!

A 2018 page announcing the base API, and a devtool page about the virtual authenticator debugger is not relevant to this new extensions.

The thing that’s an unshipped proposal is the sign extension.

So my point stands, nothing new and useful in this at all and nothing they announced is usable for anybody today.

Or am I mistaken? What new thing will you, or anybody, do with this 5.8 announcement?

"Here are 2 things, but you can only have 1," it seems.

I'm a bit emotional after an extremely long and aggravating day at work, so this is probably situational based, but I HATE the whole god damn security field, and this is one of many examples of why.

It's impossible to get simple explanations out of anybody in that field. And it's why security has always been a pain. It's like they're allergic to making plain, straightforward sense.

Here’s what this actually means for people who expect stuff to matter in any practical terms.

5.8 changes zero things about how you work. You cannot upgrade older keys to it, you have no reason to buy it, and the two features actually in there have never once been used by anyone outside a lab. The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything. The spec is an open pull request. If it ever ships it's years out, and it wont be you that starts using it first, it would have to be some big auth entity.

The ARKG thing: same, plus it needs a wallet ecosystem that doesn't exist yet.

Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware, and wrote three pages about AI to sell it. That's the actual story.

bleh.

One of many reasons I would assume is that people just hate anything related to AI, so they latch on to anything negative they can say.

Another reason is that they mean what they say... That they really, really hate the style of writing, enough to fixate on that.

Personally, I think the people whining about the style are silly. Maybe because I'm terrible at grammar and spelling, but I always just focus on the message, not the delivery. I just care about the concept, facts, the argument, and so forth. The actual grammar and spelling are just trees, while the forest is the point.

Edit: just an infobit: The reason my text isn't full of errors is due to the awesomeness of the dictation and a custom hotkey I have created on my computer, which uses a local LLM to spellcheck any text I have selected and replaces it with the corrected one. Nothing has improved my quality of life and writing more than these two tools!

Same, I am actually able to reach my weekly limit, but when I start going below 30%, I switch to normal speed, and that usually gets me through the week.

I absolutely save money and time by constantly using everything at the highest reasoning. I guess my use case and needs are different from others, but I really don’t understand how it can be true when people say they don’t need the highest reasoning and best model. Every time I drop down, things are missed, code gets unnecessarily bloated, more mistakes, and more iterations to solve the same problem. I think it might be because I’m spending a lot of time in a legacy system that I’m trying to clean up, and given the messiness, one needs all the reasoning available to decode what the hell is going on in there.

Better title more in line with the content of the article would have been: The reports of tokenmaxxing’s death are greatly exaggerated.

Pet peeve of mine is nonsensical usage of the x is dead, long live x.

Can you say p-hacking? It was designed and powered to test whether prenatal vitamin D reduces childhood asthma/wheeze, and found no effect on that primary outcome. The rest is just shuffling numbers and statistical methods around until something with p > .05 pops out.

They flags their own post hoc status, reports modest effect sizes, and applies some multiple-comparison correction. That makes the rhetorical sleight of hand harder to spot, because it's buried inside otherwise careful looking work.

The statistics are shit. They applied Benjamini-Hochberg FDR correction within cognitive domains, not across the family of 11 functions. That choice is what produced the headline "memory survived correction."

Watch what happens with the actual numbers. The two "winning" functions, verbal memory (p = .02) and visual memory (p = .01), both sit inside the memory domain — which contains exactly those two functions. BH within a 2-member family barely adjusts anything: the most lenient threshold is just 0.05, and both p-values are already under it, so the q-values come back at .02 and .02. The correction was toothless by construction, because the two hits happened to fall in the same tiny domain. A reviewer should have made them show the whole-family result side by side. The fact that they didn't is the tell. And there is much more that could be criticized in the same manner across the whole thing.

And then the observational data fail to corroborate the supplementation finding. The authors explain the mismatch via trimester timing of exposure, which is plausible, but the equally plausible reading is that the RCT hits are fragile, or that, more probably, it's not a real effect.

And even if there was an effect, it's so small and weak and NOT proven by even this data, that the recommendation for supplementation is not warranted at all. At best, this single study with their focus on recreating this effect is the only defensible conclusion. And yet they recommend supplementation.This is pure bias and D-vitamin cult babble once again.

The conclusion, based on the actual data, is: in a vitamin-D-sufficient cohort, high-dose prenatal D3 was not associated with offspring cognition on any whole-battery-corrected measure.

I hate this so much because it's stupidity like this that shows that science is not worth paying attention to, because the scientists basically lie through their teeth, at least from my perspective, where truth is something that is verifiable and relates to something real.

Indeed. Never buying a windows computer ever again. Every time I use it I get angry.

Initial testing feels better than 4.8 And the knowledge cutoff claim of January 2026 seems to check out since it was able to "remember" without search about the double-tap killing of a drug smuggler by the US Army in late December.

One could probably argue that, if interpreted in a certain way, most of these laws/rules could be good. Even the god praising could be seen positively if one subtly transforms "god" into something like "that which is good," as many secular philosophers have done.

However, this rule cannot be shown to be universally good, regardless of interpretation:

"Obey in all things the commands of those whom God has placed in authority over you, even though they (which God forbid) should act otherwise, mindful of the Lord's precept, 'Do what they say, but not what they do.'"

It’s just not logical or empirically coherent. We could deconstruct this stupidity extensively, but it would not fit within the margin of this thread.

Oh goody. I left windows but this really makes me want to come back: More control over widgets and feed experiences!

What a list of bangers!

I found this an incredibly well written and interesting read. A bit of a strange format… is it an article or a newsletter or something else? It is extremely long. I don’t really care though. Because I loved the combination of quotes, insights and links. Thanks.

Nothing. MCP and HTTP APIs and CLI tools without the good parts. They lack the robustness of the OpenAPI spec, including security standardization, and are more complex to run than simple CLI utilities without any authentication.

I have done it many times, using the swagger.json as a "discovery service" and then having the agent utilize that API. A good OpenAPI spec was working perfectly fine for me all the way back when OpenAI introduced GPTs.

If we standardized on a discovery/ endpoint, or something like that, as a more compact description of the API to reduce token usage compared to consuming the somewhat bloated full OpenAPI spec, you would have everything you need right there.

The MCP side quest for AI has been one of the most annoying things in AI in recent years. Complete waste of time.

The low ratio of quality original reporting vs political and opinion pieces made stop reading the verge.

Code is less and less the scares resource.... Good documentation is.

I think you just heard that word and use it because it makes you sound like a logical person. It’s not fitting at all here. After all, a straw man would be me taking a general claim and creating the weakest version of that argument.

If anything, you should argue that it’s overgeneralization, over-extrapolation, or an argument from authority. Hell, if you involved the concept of non sequitur, it would be better.

It’s like you’re cobbling together words related to scientific rigor without understanding the concepts. A hypothesis is, by definition, based on incomplete data. If it wasn’t, it would just be called an observation. So you make a hypothesis, see how it fits the data, and maybe even see how well it predicts the future.

Tell me what I’m wrong about?

I have absolutely no frustration with my clients. Be it psychopaths, social anxiety, pedophilia, or schizophrenia. I think I currently actually like all of my clients. And I think all of them I appreciate my approach. Because with them, I don’t care about labels. I only care about figuring out together what the real problem is. Can I accept who they are no matter what their problem is, or who they are. The only thing I “fight”, metaphorically, against self deception.

That doesn’t mean that diagnosis is are handy quick references for the topic at hand.

Obviously, I don’t talk so directly confrontation with my clients as I do on a forum, but I follow the same principle. If I disagree on their own self assessment, I talk with them about it until we both agree on what the real problem is. Sometimes I’m wrong. Sometimes the diagnosis label people give themselves is a defense mechanism.

There’s an underlying pattern to the negative responses. “ how dare you suggest that people should work on improving themselves”

Yes. The terrible ideology of working on yourself not blaming the world! It’s only the core of almost all psychotherapy approaches, self-help book, secular self improvement programs, and religions ever.

There is absolutely no empathy in not helping people with the actual problem. Using ASD protocol on someone who has a personality disorder is going to make things worse.

It sounds to me like you have no empathy for all the people who are afraid to acknowledge that they have an autism diagnosis because it has become a fashionable diagnosis.

If you look at your response to me making serious points about the need for valid diagnoses and criteria to conduct proper research and find the best treatment methods for everyone, you use this to assume that I don’t think everyone should get help.

For instance, I get extremely annoyed when people misdiagnose borderline personality disorder by calling it bipolar. If you use the treatment protocol for bipolar disorder, you’re going to make it worse for the person.

Do you think I’m dismissing their suffering and dismissing their plight? I love helping people. How many people have you heard of going to a clinician and ending up talking about something that wasn’t really their issue, spending years going through the motions? Much of that is not working on the correct problem. So I actually think it’s extremely dangerous, destructive, and unempathic towards the people who are suffering to glorify avoidance of the real issues and attack anybody who tries to help people focus on the issue.

The best example of how naïve you are regarding real psychological therapy is when you say it’s easier to diagnose narcissistic personality disorder. It’s one of the hardest things to do. It’s infinitely easier to just agree with everything the person says, give them the ADHD or PTSD diagnosis, and let them sit with it for 10 years while suffering and avoiding working on themselves.

Yes, I am the one without empathy.

you’re correct. I was just using it to emphasize how all encompassing regulation sometimes feel. I was annoyed and didn’t think; when seeing just another European regulation piling on then endless sea of things you can get fined for here.

Cypress was the last placed in Europe to remove laws against suicide in 2021 it seems.

I agree that "sardonic" is a better word. It’s just not used much, and it didn’t even come to mind. It's similar to how people misuse "ironic." But people usually understand what is meant.

The general thrust of the underlying messagr is not dishonest just because you say so. The general pattern is that there are degrees of governmental control over people's lives at the core. I don’t think it’s dishonest because my point is that bureaucracy has no limit on what it tries to control given enough time, even though my framing is vulgar.

and should we do stuff to reduce waist and help the environmen? Absolutely!! should we do this? if this worked, it would be a good thing. But if you just want to virtue signal without caring about reality, I think we disagree on more than just definitions.

My reference to "Freakonomics" is a collection of real contradictions to your theory. Since you didn't consider it, here are the expanded findings:

Most of the "recycled" material collected under these new laws is being "downcycled" into insulation, mattress stuffing, or industrial rags—markets that are already saturated and low-value. Reports show these organizations were overwhelmed with low-quality fast fashion that they could not sell. Instead of companies paying to burn it, the charities now had to pay to store or manage it.

The fines are real. France has set fines of up to €15,000 per infraction for companies caught destroying unsold goods. This is why companies are dumping the stock on charities rather than risking the fine. I’m giving how you speak about corporation. I’m guessing you have absolutely no empathy for people who run small single person or small team business and our overwhelmed by all the regulatory traps they can fall into at any point in time.

Then The Freakonomics data (Sanford, Maine case study) showed that when you charge people for trash, they generate less trash, but illegal dumping often spikes, forcing the city to spend more on cleanup patrols.

To pay for this new collection and sorting system, brands pay an "Extended Producer Responsibility" (EPR) fee. In 2025, this fee for textiles in systems like France/Netherlands ranged roughly from €0.12 to €0.50 per kilogram of clothing put on the market. In other words, the cost ultimately falls back on consumers.

So in general, no, I don’t agree at all. I think you are discounting the massive cost to not just corporations but also individuals when it comes to micromanagement. On a second layer, I’m not even against micromanagement, just bad micromanagement, especially micromanagement that is at best naïve regarding effectiveness, and at worst purely virtue signaling.

In short, we should focus on what works, not what you feel is righteously good.

Makes sense. It’s already illegal to even attempt to commit suicide here, so compared to that, this is just another small way the state micromanages your entire life.

Sarcasm aside, I wonder if they calculated how much we save by not trashing these items, versus the cost in time, bureaucracy, and administration this will demand. There is an episode of Freconomics that covered this. Managing and getting rid of free stuff is very expensive and hard. But that someone else's problem.

As I wrote in the opening. That’s exactly what we do all the time. It’s called case formulation. It’s called hypothesis testing. In this case it’s also common sense about human nature.

Because it’s annoying that people can’t even stick with the criteria that are basically the same across all the major diagnostic manuals. And because I believe that words and concepts should mean somethin. Because it’s proof that they are not really as focused on details as they claim.

Every time someone wrongly claim they have PTSD, which is a lot these days, they water down and diminish the experience of people who have experienced severe and real trauma.

Said another way. Because it’s egotistical.

For the record, I have worked with hundreds of people with ASD and helped them understand how to navigate social relations. And I’ve tried to work with people that claim they have ASD, but in reality, just use it as an excuse to be a jackass. Guess which ones of them are defensive with regards to their pet diagnosis?

Neither ADHD nor OCD have anything to do with communication style, 'being five steps ahead,' or patterns of interpersonal friction. The only symptom that remotely fits here is impulsive speech, and that's sporadic, it doesn't produce a consistent pattern of seeing yourself as above your colleagues, and its not related to the content style of the speech.

This is something i see allot of. People project what they want onto their pet diagnosis, without knowing what the diagnosis actually is. And god know what people mean when they say neurodevergent these days. The only thing i know for certain is that it never maps on to anything from real spectrum disorders.

OCD is ritualistic and compulsive behavior, often performed to decrease a negative feeling. It has nothing to do with anything described in the article or this thread. What does fit the described behavior: Rigidity, perfectionism, a need to do things the 'correct' way regardless of social cost,is OCPD, which is something completely different. And there is another diagnosis that is blindingly obvious but i wont name it out here.

There should also be noted that there are plenty of extremely smart people who don't end up in this pattern. If you're looking for myths, start with the myth of the troubled genius.

And a gift of seeing all possible solutions obviously doesn't extend to the interpersonal friction you're describing. The person you're replying to tried to point this out, and tried to communicate that you are missing something about the situation. I doubt it's the first time someone has. This reply is itself an example that just confirms the hypothesis: Someone offered feedback, and instead of sitting with it, you defended, reframed, and redirected blame outward. That's exactly the pattern I described.

The people to who take too much responsibility are not the one that "makes it other peoples problem", unless they are suffering from a dependent personality disorder.

And even then, consider rearranging what you just said in your reply. You are saying: You have to make it someone else problem to avoid self hatred and burnout.

There is a difference in relying and getting support from people, and being a jackass.

I'd push back gently on 'just shut up' as the solution. In my experience, people like you are usually CORRECT about the problem, and the anger and annoyance is well funded. It can be annoyance with the bad architecture, the wasteful meetings, the dysfunctional team dynamics. But you are falling into the same pattern as the author... Where it breaks down is treating 'being right' as the end of the job. Figuring out how to get others to see what you see, that's the actual unsolved problem, and it is more often than not solvable. Giving up on it means real problems stay unfixed, which helps nobody. If you channel the energy into solving what annoys you, in a productive way, you make both your life and your team better.

I find that there is a big difference between how people that use the fact that they are "A perfectionist OCD person".

Some wield it at a weapon. Some use it as an excuse. Some start with the assumption that it can be harness into something good. And some beat them self up over it uses it to degrade them self.

I think its most helpful to view it as a "know thy self" data point, and not make it someone else problem, but use it as information as to what is ones own challenges that must be kept in check. And if one is relay good, use it for something productive.